SVG Animation Bypass in ApostropheCMS by sanitize-html

CVE-2026-113657

What is CVE-2026-113657?

A security issue has been identified in ApostropheCMS's sanitize-html component, which is designed to sanitize HTML content. The vulnerability arises when an application configuration allows namespace-prefixed SVG animation elements. In specific scenarios, this can result in a bypass of the SMIL URL protection. The compromised element may lead to unsafe URI links being rewritten after the SVG is sanitized and rendered. If a user interacts with the affected SVG link, this can potentially execute scripts, posing a security risk. The issue was resolved in version 2.18.0 of sanitize-html, ensuring enhanced security for users.

References