NPM: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

NPM: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close vulnerability discovered by ? in WordPress Npm sanitize-html versions = 2.17.5...

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

Summary A mutation-XSS / allowedTags bypass: when textarea or xmp is included in allowedTags, an input containing a literal a solidus right after the RCDATA end-tag name lets non-allowed markup such as pass through sanitizeHtml live and unescaped, even though img/onerror are not in the allowlist....

EUVD-2026-60440

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close...

CVE-2026-84371

A flaw was found in sanitize-html. Improper validation of the animation value attributes in SVG files allows an attacker to bypass scheme filters and embed a malicious script destination within a list of values. When a user interacts with the rendered SVG animation, the embedded script executes i...

Linux Distros Unpatched Vulnerability : CVE-2026-84371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until...

NPM: ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

NPM: ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass vulnerability discovered by ? in WordPress Npm sanitize-html versions = 1.9.0, = 2.17.6...

GHSA-G8QQ-57P8-GGW5 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

Summary When SVG animation is allowed, attributeName="href" makes values a list of URL destinations. sanitize-html accepts a list that starts with a safe fragment even when values is explicitly scheme-checked, allowing a later javascript: destination to execute when the sanitized link is activate...

ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

Summary When SVG animation is allowed, attributeName="href" makes values a list of URL destinations. sanitize-html accepts a list that starts with a safe fragment even when values is explicitly scheme-checked, allowing a later javascript: destination to execute when the sanitized link is activate...

CVE-2026-84371

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

EUVD-2026-69654

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

CVE-2026-84371

ApostropheCMS (Node.js CMS) shipped a sanitize-html package vulnerable to stored XSS via SVG SMIL animation elements from version 1.9.0 through 2.17.7 . The root cause is in packages/sanitize-html/index.js, which validates the values attribute as a single flat URL, failing to account for SVG SMIL...

CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

PT-2026-84509

Name of the Vulnerable Software and Affected Versions sanitize-html versions 1.9.0 through 2.17.6 Description In configurations that allow animate, animateColor, animateMotion, animateTransform, or set elements, the packages/sanitize-html/index.js file fails to correctly validate the values...

7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +2032 more potentially affected by CVE-2026-63670 via sanitize-html (>=2.1.0, <=2.17.5)

sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =1.0.0, =3.0.0, =1.3.0, =1.0.0, =1.38.0, =1.3.2, =1.7.1 and more Source cves: CVE-2026-63670 Source advisory: SNYK:JS-SANITIZEHTML-18913500...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS (open-source Node.js CMS) is vulnerable to a mutation XSS in sanitizeHtml() (packages/sanitize-html/index.js) prior to version 2.17.6 . When textarea or xmp is included in allowedTags, a literal solidus after the raw-text end-tag name (e.g., ) is treated as text by htmlparser2 , and...