Node.js Content Management System Vulnerability in ApostropheCMS
CVE-2026-113650

5.3MEDIUM

Key Information:

Vendor: Apostrophecms
Status: Apostrophe; Sanitize-html
Vendor: CVE Published:; 20 October 2026

🔔 Create Apostrophecms Vulnerability Alert

What is CVE-2026-113650?

ApostropheCMS, an open-source Node.js content management system, contains a flaw in sanitize-html version 2.18.0. This vulnerability arises when an element is not permitted and the disallowedTagsMode is set to 'discard'. The raw-text content is resanitized through a recursive call without limit, initiating new state for each nested call. Such behavior can lead to severe unintended vulnerabilities. This issue has been addressed in version 2.18.1. Users are encouraged to upgrade to this version to ensure the integrity and security of their applications.