HTML Sanitization Flaw in ApostropheCMS by Apostrophe

CVE-2026-113654

What is CVE-2026-113654?

A vulnerability in ApostropheCMS's sanitize-html prior to version 2.18.0 allows for improper sanitization of HTML content. An incorrectly configured nonTextTags setting that includes 'noscript' could allow potentially harmful scripts to survive sanitization and be rendered in browsers, as the handling of 'noscript' content differs between browsers and the HTML parser. This flaw poses a risk as content meant to remain inactive may be executed, compromising security. Users are advised to upgrade to sanitize-html version 2.18.0 or later to mitigate this issue.

References