sanitize-html vulnerabilities (TuxCare)

9 vulnerabilities.

• sanitize-html TuxCare ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs CVE-2026-113661 Fix available 5.4 MediumOctober 20, 2026
• sanitize-html TuxCare ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render CVE-2026-113654 Fix available 5.3 MediumOctober 20, 2026
• sanitize-html TuxCare ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass CVE-2026-84371 Fix available 5.4 MediumSeptember 1, 2026
• sanitize-html TuxCare sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes CVE-2026-53606 Fix available 5.4 MediumJune 12, 2026
• sanitize-html TuxCare sanitize-html is vulnerable to XSS through incomprehensive sanitization CVE-2019-25225 Fix available 6.1 MediumSeptember 8, 2025
• sanitize-html TuxCare sanitize-html Information Exposure vulnerability CVE-2024-21501 Fix available 5.3 MediumFebruary 24, 2024
• sanitize-html TuxCare Regular Expression Denial of Service (ReDoS) CVE-2022-25887 Fix available 5.3 MediumAugust 30, 2022
• sanitize-html TuxCare Improper Input Validation in sanitize-html CVE-2021-26540 Fix available 5.3 MediumFebruary 8, 2021
• sanitize-html TuxCare Improper Input Validation in sanitize-html CVE-2021-26539 Fix available 5.3 MediumFebruary 8, 2021