Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient sanitization of meta refresh element...

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes action, formaction, data, poster, background, later ping, xlink:href, … go through naughtyHref. A URL nested inside meta content http-equiv=refresh is not an attribute name on that list, so the embedded...

GHSA-CV27-6WVH-8X7J ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes action, formaction, data, poster, background, later ping, xlink:href, … go through naughtyHref. A URL nested inside meta content http-equiv=refresh is not an attribute name on that list, so the embedded...

npm: ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

npm: ApostropheCMS: Incomplete CVE-2026-53606: meta http-equiv=refresh content still ships javascript: / data: URLs vulnerability discovered by ? in WordPress npm sanitize-html versions 2.18.0...

CVE-2026-113661

The ApostropheCMS content management system is affected by a vulnerability in the sanitize-html library. Prior to version 2.18.0 , a non-default configuration allowing meta refresh elements could retain unsafe javascript: or data: URLs within the content attribute. This flaw can lead to unsafe sc...

CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...

CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script...

CVE-2026-93649

In the Eclipse Adoptium website adoptium.net, in every deployment built from commit 0b24ea1 2025-06-18 up to the fix in commit cbb53cf 2026-09-24, the post-download page /locale/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta...

CVE-2026-93649

In the Eclipse Adoptium website adoptium.net, in every deployment built from commit 0b24ea1 2025-06-18 up to the fix in commit cbb53cf 2026-09-24, the post-download page /locale/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta...

CVE-2026-93649

The Eclipse Adoptium website (adoptium.net) is vulnerable to an Open Redirect and Download of Code Without Integrity Check in deployments built from commit 0b24ea1 (2025-06-18) through cbb53cf (2026-09-24). The issue resides in the /[locale]/download post-download page, which accepts a URL via th...

CVE-2026-93649

In the Eclipse Adoptium website adoptium.net, in every deployment built from commit 0b24ea1 2025-06-18 up to the fix in commit cbb53cf 2026-09-24, the post-download page /locale/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta...

CVE-2026-93649: Download of Code Without Integrity Check

In the Eclipse Adoptium website adoptium.net, in every deployment built from commit 0b24ea1 2025-06-18 up to the fix in commit cbb53cf 2026-09-24, the post-download page /locale/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta...

html/template: URLs in meta content attribute actions are not escaped in html/template

An input escaping flaw has been discovered in the golang html/template module. Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added...

CVE-2026-27142

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actio...

AZL-79634 CVE-2026-27142 affecting package msft-golang 1.24.13-1

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actio...

AZL-79637 CVE-2026-27142 affecting package python-tensorboard 2.11.0-3

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actio...

AZL-79640 CVE-2026-27142 affecting package python-tensorboard 2.16.2-6

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actio...

AZL-98571 CVE-2026-27142 affecting package golang 1.27.1-1

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actio...

CVE-2026-27142

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actio...

CVE-2026-27142

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actio...