SVG Sanitation Flaw in ApostropheCMS by Apostrophe

CVE-2026-84371

What is CVE-2026-84371?

ApostropheCMS, a Node.js content management system, contains a vulnerability in its sanitize-html package that affects the rendering of SVG animations. Specifically, from versions 1.9.0 to 2.17.6, the sanitize-html logic does not properly validate the animation value attributes. This can lead to scenarios where a malicious SVG is sanitized improperly, allowing for executable scripts to be transmitted through SVG links. When rendered in a browser, a manipulated link can execute scripts within the site's origin, potentially compromising the application's security. Users are encouraged to upgrade to version 2.17.7 to mitigate this risk.

References