119078 matches found
CVE-2026-113654
The sanitize-html library, used in ApostropheCMS , is vulnerable to a logic error in its handling of nonTextTags configurations. Specifically, when noscript is included in a non-default configuration, the discard region can end prematurely because htmlparser2 emits an implied ancestor close. This...
CVE-2026-113654 ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied...
CVE-2026-113654 ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied...
CVE-2026-113654
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied...
CVE-2026-113650 ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options. The recursion has no bound and starts each...
CVE-2026-113650
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options. The recursion has no bound and starts each...
CVE-2026-113650 ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options. The recursion has no bound and starts each...
CVE-2026-113650 ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options. The recursion has no bound and starts each...
@asubasu/pixel-next (>=1.1.1, <=2.0.0), @biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14) +95 more potentially affected by CVE-2026-113650 via sanitize-html (2.18.0)
sanitize-html NPM version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @asubasu/pixel-next =1.1.1, =0.1.13, =0.2.0, =9.0.4, =0.1.1, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =1.0.16, =9.6.0, =9.7.1 and more Source...
CVE-2026-113650
The ApostropheCMS Node.js content management system is vulnerable in the sanitize-html 2.18.0 component due to unbounded recursion . When an is disallowed and disallowedTagsMode is set to 'discard' (the default), the raw-text content undergoes a recursive re-sanitization via sanitizeHtml(text, o...
CVE-2026-112958
The ApostropheCMS Node.js content management system is vulnerable to Stored XSS in versions prior to 4.34.0 . The root cause is a lack of HTML-attribute encoding within the wrapper serializer for project-defined free-form widget style fields. An editor can inject an unescaped quote into an inline...
CVE-2026-112958 ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the...
CVE-2026-112958 ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the...
CVE-2026-112958 ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the...
PHPOffice PHPPresentation cross-site scripting vulnerability
PHPOffice PHPPresentation version 1.2.0 contains a cross-site scripting vulnerability. This flaw stems from issues in its HTML writer, allowing attackers to craft PPTX files containing malicious text segments, hyperlink targets, or shape desc attributes without proper escaping. As a result, these...
html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword
A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...
CVE-2026-113583
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...
CVE-2026-113583
Cypht webmail versions 2.0.0 through 2.12.2 are vulnerable to a Stored DOM-based Cross-Site Scripting (XSS) flaw. When the ALLOW_EXTERNAL_IMAGE_SOURCES setting is enabled, an attacker can execute arbitrary JavaScript by sending a specially crafted email. The vulnerability exists because the exter...
CVE-2026-113583 Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...
CVE-2026-113583 Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...