CVE-2026-53606 Details
Description
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-html prior to 2.17.5 use `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `naughtyHref()` function that blocks dangerous URI schemes like `javascript:` and `vbscript:`. The HTML specification defines 10+ attributes that accept URIs (`action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, `lowsrc`), but none of these are included in the default gate list. When a developer allows any of these attributes in their configuration, `javascript:` URIs pass through completely unmodified, enabling XSS. Version 2.17.5 patches the issue.
A cross-site scripting (XSS) vulnerability has been identified in the sanitize-html library, used by ApostropheCMS, prior to version 2.17.5. The issue arises because the library's default configuration does not properly validate URI schemes for several attributes that accept URIs, such as 'action', 'formaction', 'data', 'poster', and 'background'. When developers allow these attributes in their configuration, dangerous 'javascript:' URIs can pass through unmodified, leading to XSS attacks. This vulnerability requires non-default settings, making it a common risk for CMS platforms, form builders, and rich content editors.
Users can upgrade to sanitize-html version 2.17.5 or later, or expand the default 'allowedSchemesAppliedToAttributes' list to include 'action', 'formaction', 'data', 'poster', 'background', 'ping', 'xlink:href', 'dynsrc', and 'lowsrc'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vccv-cmxp-4j9h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vccv-cmxp-4j9h | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ApostropheCMS | All versions |
CPE
Remediation
| |
| sanitize-html | <= 2.17.4 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |