Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-113654 · GHSA-x3q4-9hxx-gx8m

ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

Risk score
42/100
CVSS
5.3 v4.0
Exploit chance (30 days)
0.3%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside …
Affected
sanitize-html (npm) < 2.18.0
Fix
Upgrade sanitize-html to 2.18.0 or later.
Exploitation
No known exploitation

Story map

Story map: sanitize-htmlTHE FLAWSTHE FIXCVE-2026-113654ApostropheCMS sanitize-html:nonTextTags discard regionends early on an implied close…CVSS 5.3 · EPSS 0%CVE-2026-113650ApostropheCMS sanitize-html:unbounded recursion whenre-sanitizing the fallback of a…CVSS 5.3 · EPSS 0%CVE-2026-113661ApostropheCMS: IncompleteCVE-2026-53606: `metahttp-equiv=refresh`…CVSS 5.4 · EPSS 0%Upgrade sanitize-html2.18.1or later on your release lineWho is exposedsanitize-html (npm) < 2.18.0YELLOW · PLAN IT INsanitize-htmlApostropheCMS is anopen-source Node.js contentmanagement system, andsanitize-html provides a simpleHTML sanitizer with a clearAPI. Prior to sanitize-html2.18.0, a non-default…Where it standsNo known exploitationCONNECTS TOSame weaknessCross-site scripting (CWE-79)398 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

sanitize-html: Yellow, plan it in. ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside …

The flaws

  • CVE-2026-113654: ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render (CVSS 5.3 · EPSS 0%)
  • CVE-2026-113650: ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) (CVSS 5.3 · EPSS 0%)
  • CVE-2026-113661: ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs (CVSS 5.4 · EPSS 0%)

The fix

Upgrade sanitize-html: 2.18.1 or later on your release line

Who is exposed: sanitize-html (npm) < 2.18.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
sanitize-htmlnpm< 2.18.02.18.0

References

Original description

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.

Last activity 20 Oct 2026. Patch Forecast updates every hour.