CVE-2026-53606mediumCWE-79

CVE-2026-53606: medium-severity vulnerability in apostrophecms sanitize-html

sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes

Published · Updated

Follow this CVE+ Monitor sanitize-html+ Monitor sanitize-html

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.2%
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-html prior to 2.17.5 use `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `naughtyHref()` function that blocks dangerous URI schemes like `javascript:` and `vbscript:`. The HTML specification defines 10+ attributes that accept URIs (`action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, `lowsrc`), but none of these are included in the default gate list. When a developer allows any of these attributes in their configuration, `javascript:` URIs pass through completely unmodified, enabling XSS. Version 2.17.5 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
apostrophecms · sanitize-html
Related CVEs — apostrophecms sanitize-html

In the same product, most dangerous first.

CVE-2026-44990CRITICALApostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`EPSS 0.7%CVE-2026-113650MEDIUMApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)EPSS 0.5%CVE-2026-113654MEDIUMApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderEPSS 0.4%CVE-2026-113657LOWApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)EPSS 0.3%CVE-2026-113661MEDIUMApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsEPSS 0.3%CVE-2026-40186MEDIUMApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags ElementsEPSS 0.2%