CVE-2026-113657lowCWE-79

CVE-2026-113657: fallo de gravedad baja en apostrophecms apostrophe

ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

Publicada el

Seguir esta CVE+ Monitorear ApostropheCMS+ Monitorear sanitize-html

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.7epss 0.3%
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Productos afectados
apostrophecms · apostropheapostrophecms · sanitize-html
CVEs relacionadas — apostrophecms apostrophe

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-44990CRITICALApostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`EPSS 0.7%CVE-2026-113658HIGHApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryEPSS 0.6%CVE-2026-113711HIGHApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportEPSS 0.6%CVE-2026-112953MEDIUMApostropheCMS: Exposure of Sensitive Information via predictable export filenamesEPSS 0.6%CVE-2026-112955MEDIUMApostropheCMS: Import archives can exhaust server storage and deny serviceEPSS 0.5%CVE-2026-33888MEDIUMApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST APIEPSS 0.5%