CVE-2026-113654

UNKNOWN 0.0

ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.

CWE	CWE-79
Vendor	apostrophecms
Product	apostrophe
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for apostrophecms apostrophe

Be the first to know when new unknown vulnerabilities affecting apostrophecms apostrophe are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

apostrophecms / apostrophe

< 4.33.0

apostrophecms / sanitize-html

< 2.18.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-x3q4-9hxx-gx8m github.com: https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce github.com: https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350 github.com: https://github.com/apostrophecms/apostrophe/releases/tag/[email protected]