CVE-2026-113650 Details
Description
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.
A vulnerability in ApostropheCMS's sanitize-html package version 2.18.0 allows for unbounded recursion when re-sanitizing the fallback of discarded iframe elements. This issue can lead to a stack overflow, as the recursion has no limit and each nested call starts with a fresh state. The vulnerability arises because the default handling of iframes, when not allowed, is to discard them but recursively re-sanitize their content. This behavior can be exploited by crafting input that includes unclosed iframe tags, causing the sanitization process to exceed the maximum call stack size.
Users can upgrade to sanitize-html version 2.18.1, where this vulnerability is fixed. The updated version enforces the nesting limit correctly, preventing the unbounded recursion issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-c9rx-x947-fp3h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498 | [email protected] | Source CodeVendor |
| https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea | [email protected] | Source CodeVendor |
| https://github.com/apostrophecms/apostrophe/releases/tag/[email protected] | [email protected] | Source CodeVendor |
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-c9rx-x947-fp3h | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ApostropheCMS | All versions |
CPE
Remediation
| |
| sanitize-html | >= 2.18.0, < 2.18.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |