SUSE CVE-2026-84371

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

Linux Distros Unpatched Vulnerability : CVE-2026-84371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until...

GHSA-G8QQ-57P8-GGW5 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

Summary When SVG animation is allowed, attributeName="href" makes values a list of URL destinations. sanitize-html accepts a list that starts with a safe fragment even when values is explicitly scheme-checked, allowing a later javascript: destination to execute when the sanitized link is activate...

Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS via the SVG SMIL animation handling in...

ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

Summary When SVG animation is allowed, attributeName="href" makes values a list of URL destinations. sanitize-html accepts a list that starts with a safe fragment even when values is explicitly scheme-checked, allowing a later javascript: destination to execute when the sanitized link is activate...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the SVG SMIL animation handling in packages/sanitize-html/index.js. An attacker can execute JavaScript in the application’s origin by supplying an allowed or element with attributeName="href" or xlink:href"...

NPM: ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

NPM: ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass vulnerability discovered by ? in WordPress Npm sanitize-html versions = 1.9.0, = 2.17.6...

CVE-2026-84371

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

EUVD-2026-69654

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

CVE-2026-84371

ApostropheCMS (Node.js CMS) shipped a sanitize-html package vulnerable to stored XSS via SVG SMIL animation elements from version 1.9.0 through 2.17.7 . The root cause is in packages/sanitize-html/index.js, which validates the values attribute as a single flat URL, failing to account for SVG SMIL...

PT-2026-84509

Name of the Vulnerable Software and Affected Versions sanitize-html versions 1.9.0 through 2.17.6 Description In configurations that allow animate, animateColor, animateMotion, animateTransform, or set elements, the packages/sanitize-html/index.js file fails to correctly validate the values...

CVE-2026-84371: Improper Neutralization of Input During Web Page Generation

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...