ApostropheCMS Sanitize-html: Unbounded Recursion When Re-sanitizing The Fallback Of A Discarded Iframe (stack Overflow,

Summary Since 2.18.0, when an "" is not allowed and "disallowedTagsMode" is "'discard'" the defaults, its raw-text content is re-sanitized by a recursive call to "sanitizeHtmltext, options" the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh stat...

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

Summary Since 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh state. Two...

npm: ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

npm: ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe stack overflow, nestingLimit not enforced vulnerability discovered by ? in WordPress npm sanitize-html versions = 2.18.0, 2.18.1...

npm: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

npm: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection XSS vulnerability discovered by ? in WordPress npm sanitize-html versions = 2.17.7, 2.18.0...

npm: ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

npm: ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting content render vulnerability discovered by ? in WordPress npm sanitize-html versions 2.18.0...