CVE-2026-113654 Details
Description
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.
A vulnerability exists in ApostropheCMS versions prior to 2.18.0, specifically within the sanitize-html package. The issue arises when a non-default nonTextTags configuration includes the noscript tag, causing the sanitizer to improperly discard content. This mismanagement allows noscript content, which browsers with scripting enabled treat as raw text, to escape sanitization and render on the page. The vulnerability does not affect all nonTextTags elements but is specific to noscript.
Users can upgrade to sanitize-html version 2.18.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-x3q4-9hxx-gx8m | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce | [email protected] | Source CodeVendor |
| https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350 | [email protected] | Source CodeVendor |
| https://github.com/apostrophecms/apostrophe/releases/tag/[email protected] | [email protected] | Source CodeVendor |
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-x3q4-9hxx-gx8m | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ApostropheCMS | All versions |
CPE
Remediation
| |
| sanitize-html | < 2.18.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |