ApostropheCMS Sanitize-html: Unbounded Recursion When Re-sanitizing The Fallback Of A Discarded Iframe (stack Overflow,

Summary Since 2.18.0, when an "" is not allowed and "disallowedTagsMode" is "'discard'" the defaults, its raw-text content is re-sanitized by a recursive call to "sanitizeHtmltext, options" the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh stat...

GHSA-C9RX-X947-FP3H ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

Summary Since 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh state. Two...

@asubasu/pixel-next (>=1.1.1, <=2.0.0), @classic-homes/theme-docs (>=0.2.0, <=0.10.0) +88 more potentially affected by CVE-2026-113650 via sanitize-html (2.18.0)

sanitize-html NPM version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @asubasu/pixel-next =1.1.1, =0.2.0, =1.1.4, =1.0.0, =0.1.1, =0.1.89, =1.0.183, =2.0.3, =24.0.0, =0.1.2, =2.0.5, =0.2.0, =0.2.0, =1.0.3...

@asubasu/pixel-next (>=1.1.1, <=2.0.0), @classic-homes/theme-docs (>=0.2.0, <=0.10.0) +88 more potentially affected by CVE-2026-113650 via sanitize-html (2.18.0)

sanitize-html NPM version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @asubasu/pixel-next =1.1.1, =0.2.0, =1.1.4, =1.0.0, =0.1.1, =0.1.89, =1.0.183, =2.0.3, =24.0.0, =0.1.2, =2.0.5, =0.2.0, =0.2.0, =1.0.3...

EUVD-2026-105176

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe stack overflow, nestingLimit not enforced...

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

Summary Since 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh state. Two...

npm: ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

npm: ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe stack overflow, nestingLimit not enforced vulnerability discovered by ? in WordPress npm sanitize-html versions = 2.18.0, 2.18.1...

Linux Distros Unpatched Vulnerability : CVE-2026-113661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html...

Linux Distros Unpatched Vulnerability : CVE-2026-113654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html...

Linux Distros Unpatched Vulnerability : CVE-2026-113650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the...

Linux Distros Unpatched Vulnerability : CVE-2026-113657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17....

CVE-2026-113654

A flaw was found in sanitize-html. A remote attacker can bypass HTML sanitization by submitting specially crafted markup when the library is configured to strip noscript tags. In this scenario, the parser can prematurely terminate the discard region, allowing unsanitized content to persist and...

CVE-2026-113650

A flaw was found in sanitize-html. A remote attacker can cause a Denial of Service DoS by submitting specially crafted HTML input containing disallowed iframe elements. Under default configurations, the library re-sanitizes iframe content through unbounded recursive calls, exhausting system...

CVE-2026-113657

A flaw was found in sanitize-html. This vulnerability allows a remote attacker to achieve arbitrary script execution when an application is configured to permit namespace-prefixed Scalable Vector Graphics SVG animation elements. By submitting specially crafted SVG markup, an attacker can bypass U...

CVE-2026-113661

A flaw was found in sanitize-html. In configurations where meta refresh elements and their attributes are permitted, the sanitizer fails to properly filter unsafe scripts or redirect destinations within the refresh content value. A remote attacker could exploit this vulnerability by submitting...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via its transitive dependency on deepmerge, which is affected by CVE-2026-93753. When sanitize-html merges configuration objects combining tag-specific and wildcard allowedClasses or allowedStyles entries, the...

@asubasu/pixel-next (>=1.1.1, <=2.0.0), @classic-homes/theme-docs (>=0.2.0, <=0.10.0) +88 more potentially affected by CVE-2026-113650 +1 more via sanitize-html (2.18.0)

sanitize-html NPM version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @asubasu/pixel-next =1.1.1, =0.2.0, =1.1.4, =1.0.0, =0.1.1, =0.1.89, =1.0.183, =2.0.3, =24.0.0, =0.1.2, =2.0.5, =0.2.0, =0.2.0, =1.0.3...

Uncontrolled Recursion

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Uncontrolled Recursion via its transitive dependency on deepmerge, which is...

7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +2137 more potentially affected by CVE-2026-113654 via sanitize-html (>=2.1.0, <=2.17.7)

sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =1.0.0, =3.0.0, =1.3.0, =1.0.0, =1.38.0, =1.3.2, =1.7.1 and more Source cves: CVE-2026-113654 Source advisory: SNYK:JS-SANITIZEHTML-21281012...

Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS via the nonTextTags configuration when noscript is...