CVE-2021-26539

Improper Input Validation in sanitize-html

5.3 MediumFix available

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

1.98%Up 1.1 points since Apr 14, 2021

What each source reports

NVD Score used 5.3

Record: CVE-2021-26539
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-26539
Updated: 2026-11-02

EUVDEUVD-2021-1183 No score

Record: EUVD-2021-1183
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rjqq-98f6-6j3r 5.3

Improper Input Validation in sanitize-html

Record: GHSA-rjqq-98f6-6j3r
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSV 5.3

Record: CVE-2021-26539
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVGHSA-rjqq-98f6-6j3r 5.3

Improper Input Validation in sanitize-html

Record: GHSA-rjqq-98f6-6j3r
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSVCLSA-2026-1776644763 No score

TuxCare security update for sanitize-html (3 CVEs)

TuxCare rebuilt sanitize-html to address 3 CVEs. Fixed in 1.27.5-tuxcare.2.

Record: CLSA-2026-1776644763
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2021-26539 No score

CVE-2021-26539 in @rootio/sanitize-html - Patched by Root

Root has patched CVE-2021-26539 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2021-26539
Updated: 2026-11-02

Affected products

apostrophecms sanitize-html

Affected packages

Affected packages
Package	Affected	Fixed
`sanitize-html` npm	before 2.3.1	2.3.1
`sanitize-html` TuxCare:npm From an advisory covering 3 CVEs	1.27.5-tuxcare.0 up to 1.27.5-tuxcare.2, plus listed versions 1.27.51.27.5-tuxcare.1	1.27.5-tuxcare.2
`@rootio/sanitize-html` Root:npm	before 1.4.2-root.io.7	1.4.2-root.io.71.4.2-root.io.81.4.2-root.io.9
`sanitize-html` Root:npm	before 1.4.2-aikido.9	1.4.2-aikido.9

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-26539 is a medium vulnerability (CVSS 5.3) in Apostrophecms Sanitize-html, published February 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.98%, the 80th percentile. Fixed in sanitize-html 2.3.1.