Cross-Site Scripting Exposure in ApostropheCMS via sanitize-html
CVE-2026-53606

5.4MEDIUM

Key Information:

Vendor

Apostrophecms

Status
Sanitize-html
Vendor
CVE Published:
12 June 2026

What is CVE-2026-53606?

ApostropheCMS, an open-source Node.js content management system, contains a vulnerability in the sanitize-html library prior to version 2.17.5. The issue lies in how certain HTML attributes that accept URIs are not properly sanitized, allowing javascript: and potentially harmful URIs to bypass validations. This can lead to Cross-Site Scripting (XSS) attacks when unsuspecting users interact with compromised content. This vulnerability is notably critical for developers since not all URI-accepting attributes are covered by the default security measures, making it essential to upgrade to version 2.17.5 or higher to mitigate this risk.

Affected Version(s)

sanitize-html < 2.17.5

References

https://github.com/apostrophecms/apostrophe/security/advi...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.