GHSA-C9RX-X947-FP3H ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

Summary Since 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh state. Two...