CVE-2026-113657: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sanitize-htmlto a version that resolves this vulnerability.Fixed in 2.18.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Only applications using sanitize-html versions from 2.17.7 up to, but not including, 2.18.0 are potentially exposed, and only when their sanitizer configuration permits namespace-prefixed SVG animation elements together with the relevant URL-targeting attributes. The default configuration is not unconditionally affected.
What must an attacker do to exploit this issue?
An attacker must supply sanitized SVG content using namespace-prefixed SMIL animation elements that bypass the animation-element check and rewrite a link destination to an unsafe URI. Script execution occurs only when a user activates the affected rendered link.
What should be done if upgrading is not immediately possible?
Review the sanitize-html configuration and avoid allowing namespace-prefixed SVG animation elements and the relevant URL-targeting attributes together. This removes the configuration condition described as enabling the bypass.
How can I determine whether an application is affected?
Check whether the application uses sanitize-html 2.17.7 through 2.17.9 and whether its configuration allows namespace-prefixed SVG animation elements and URL-targeting attributes. Applications on sanitize-html 2.18.0 are fixed.