CVE-2026-63670

ApostropheCMS (open-source Node.js CMS) is vulnerable to a mutation XSS in sanitizeHtml() (packages/sanitize-html/index.js) prior to version 2.17.6 . When textarea or xmp is included in allowedTags, a literal solidus after the raw-text end-tag name (e.g., ) is treated as text by htmlparser2 , and...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

PT-2026-76771

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 2.17.6 Description The sanitizeHtml function in packages/sanitize-html/index.js allows disallowed executable markup to pass through when textarea or xmp are included in allowedTags. This occurs because a literal...

CLSA-2026-1786373316 TuxCare security update for sanitize-html (1 CVE)

TuxCare rebuilt sanitize-html to address 1 CVE. Fixed in 1.27.5-tuxcare.4...

PT-2026-80043

TuxCare rebuilt sanitize-html to address 1 CVE. Fixed in 1.27.5-tuxcare.4...

CLSA-2026-1776645373 TuxCare security update for sanitize-html (1 CVE)

TuxCare rebuilt sanitize-html to address 1 CVE. Fixed in 1.27.5-tuxcare.3...

CLSA-2026-1776644763 TuxCare security update for sanitize-html (3 CVEs)

TuxCare rebuilt sanitize-html to address 3 CVEs. Fixed in 1.27.5-tuxcare.2...

CLSA-2026-1775003160 TuxCare security update for sanitize-html (1 CVE)

TuxCare rebuilt sanitize-html to address 1 CVE. Fixed in 1.27.5-tuxcare.1...

PT-2026-74499

TuxCare rebuilt sanitize-html to address 1 CVE. Fixed in 1.27.5-tuxcare.3...

PT-2026-74490

TuxCare rebuilt sanitize-html to address 3 CVEs. Fixed in 1.27.5-tuxcare.2...

SUSE CVE-2026-44990

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of sanitize-html prior to 2.17.4 can turn attacker-controlled content inside a disallowed xmp element into live HTML or...

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

Summary sanitize-html uses allowedSchemesAppliedToAttributes default: 'href', 'src', 'cite' to gate the naughtyHref function that blocks dangerous URI schemes like javascript: and vbscript:. The HTML specification defines 10+ attributes that accept URIs action, formaction, data, poster, backgroun...

08cms (1.0.0), 10secondsofcode-custom (1.0.0) +4575 more potentially affected by CVE-2026-53606 via sanitize-html (>=1.18.2, <=2.17.4)

sanitize-html NPM version =1.18.2, =1.0.0, =4.11.0, =1.0.0, =1.0.0, =0.0.1, =0.6.0, =5.0.2, =0.0.1, =0.1.0, =0.1.0, =11.1.0, =1.3.0, =1.3.6 and more Source cves: CVE-2026-53606 Source advisory: GHSA-VCCV-CMXP-4J9H...

GHSA-VCCV-CMXP-4J9H sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

Summary sanitize-html uses allowedSchemesAppliedToAttributes default: 'href', 'src', 'cite' to gate the naughtyHref function that blocks dangerous URI schemes like javascript: and vbscript:. The HTML specification defines 10+ attributes that accept URIs action, formaction, data, poster, backgroun...

08cms (1.0.0), 10secondsofcode-custom (1.0.0) +4575 more potentially affected by CVE-2026-53606 via sanitize-html (>=1.18.2, <=2.17.4)

sanitize-html NPM version =1.18.2, =1.0.0, =4.11.0, =1.0.0, =1.0.0, =0.0.1, =0.6.0, =5.0.2, =0.0.1, =0.1.0, =0.1.0, =11.1.0, =1.3.0, =1.3.6 and more Source cves: CVE-2026-53606 Source advisory: OSV:GHSA-VCCV-CMXP-4J9H...

NPM: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

NPM: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes vulnerability discovered by ? in WordPress Npm sanitize-html versions = 1.18.0, = 2.17.4...

EUVD-2026-36574

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes...

Cross-site Scripting (XSS)

Overview jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser Affected versions of this package are vulnerable to Cross-site Scripting XSS in the sanitizeHTMLElement. An attacker can execute arbitrary JavaScript in the context of the user's browser by crafting a malicious href...