ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-113654

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

Published Oct 20, 2026 · catalog updated Oct 20, 2026 · ApostropheCMS is an open-source

Last checked Nov 7, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-113654. EPSS is 0.43%. Act only if a listed version of ApostropheCMS is an open-source is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (ApostropheCMS is an open-source).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.43%
Remediation
Advisory link
Affected products
npm sanitize-html

## Summary discards the *content* of every element in . It delimits that region using htmlparser2's close events, and ignores the flag htmlparser2 passes it. Closing a still-open **ancestor** from inside a makes htmlparser2 unwind its stack past the ; the synthetic implied close it emits on the way ends the discard region early, and everything after it is treated as ordinary body content. A browser with scripting enabled parses content as **raw text**, so the same markup renders as inert text there. The sanitizer therefore emits elements the page itself would not have. ## Reproduction Chrome, given the same input, renders **no** — the whole payload is raw text inside the unclosed . Verified with Playwright, into an iframe so the scripting flag is on. A variant hides the opening tag from the parser entirely and has the same effect: htmlparser2 runs a CDATA token to ; Chrome ends a bogus comment at the first , so the after it is real to the browser and invisible to the parser. ## Where the behaviour is : - — (the default list, ). - — — receives the flag. - — — decrements without consulting . ## Suggested fix Do not end a discard region on an implied close. htmlparser2 already distinguishes them; the flag is passed and discarded. Something close to:

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm sanitize-html0 → 2.18.0

How to fix CVE-2026-113654

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-113654. EPSS is 0.43%. Act only if a listed version of ApostropheCMS is an open-source is installed.

Which versions are affected?

Compare what you have installed with 0 → 2.18.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-79: Cross-site Scripting (XSS). EPSS 0.43%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 20, 2026 · NIST NVD

    Detected

    ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text w

  2. Oct 20, 2026 · GitHub Advisory Database

    Fix available

    sanitize-html fixed in 2.18.0

  3. Oct 20, 2026 · GitHub Advisory Database

    Fix available

    sanitize-html fixed in 2.18.0

  4. Oct 20, 2026 · GitHub Advisory Database

    Updated

    ## Summary discards the *content* of every element in . It delimits that region using htmlparser2's close events, and ignores the flag htmlparser2 passes it. Closing a still-open **ancestor** from inside a makes htmlparser2 unwind its stack past the ; the synthetic implied close it emits on the way ends the discard region early, and everything after it is treated as ordinary body content. A browse

  5. Oct 20, 2026 · NIST NVD

    Updated

    ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text w

Sources

  • CVE.orgVulnerability recordCVE-2026-113654

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-113654

    30-day exploitation probability 0.43%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-x3q4-9hxx-gx8m

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • NIST NVDVulnerability recordCVE-2026-113654

    ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-x3q4-9hxx-gx8m

    ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting content render

    osv.dev

References

Freshness

Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 7, 2026
  • CVE.orgOct 21, 2026
  • NIST NVDOct 21, 2026
  • GitHub Advisory DatabaseOct 20, 2026
  • OpenSSF OSV / OSV ScannerOct 20, 2026