HTML Sanitization Flaw in ApostropheCMS by Apostrophe

CVE-2026-113661

What is CVE-2026-113661?

ApostropheCMS, an open-source Node.js content management system, has a vulnerability due to improper HTML sanitization by the sanitize-html library. Specifically, prior to version 2.18.0, non-default settings allowed meta refresh elements, along with their associated http-equiv and content attributes, to permit unsafe script execution or redirects. This risk stems from embedded scripts or hazardous destinations being retained in the refresh content value, potentially leading to security breaches. Version 2.18.0 has addressed this vulnerability.

References