GHSA-X3Q4-9HXX-GX8M ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

Summary sanitize-html discards the content of every element in nonTextTags. It delimits that region using htmlparser2's close events, and ignores the isImplied flag htmlparser2 passes it. Closing a still-open ancestor from inside a makes htmlparser2 unwind its stack past the noscript; the synthet...