Apostrophecms Sanitize-html vulnerabilities

• apostrophecms apostrophe, sanitize-html +1 more ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs CVE-2026-113661 Fix available 5.4 MediumOctober 20, 2026
• apostrophecms apostrophe, sanitize-html +1 more ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) CVE-2026-113657 Fix available 3.7 LowOctober 20, 2026
• apostrophecms apostrophe, sanitize-html +1 more ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render CVE-2026-113654 Fix available 5.3 MediumOctober 20, 2026
• apostrophecms apostrophe, sanitize-html +1 more ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) CVE-2026-113650 Fix available 5.3 MediumOctober 20, 2026
• apostrophecms sanitize-html sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes CVE-2026-53606 Fix available 5.4 MediumJune 12, 2026
• apostrophecms sanitize-html, red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11 +27 more +29 more Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` CVE-2026-44990 Fix available 9.3 CriticalMay 14, 2026
• apostrophecms apostrophe, apostrophecms, apostrophecms sanitize-html +2 more ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements CVE-2026-40186 Fix available 6.1 MediumApril 15, 2026
• apostrophecms sanitize-html 'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function ... CVE-2014-125128 6.1 MediumSeptember 8, 2025
• apostrophecms sanitize-html sanitize-html is vulnerable to XSS through incomprehensive sanitization CVE-2019-25225 Fix available 6.1 MediumSeptember 8, 2025
• apostrophecms sanitize-html, fedoraproject fedora +1 more sanitize-html Information Exposure vulnerability CVE-2024-21501 Fix available 5.3 MediumFebruary 24, 2024
• apostrophecms sanitize-html Regular Expression Denial of Service (ReDoS) CVE-2022-25887 Fix available 5.3 MediumAugust 30, 2022
• apostrophecms sanitize-html Improper Input Validation in sanitize-html CVE-2021-26540 Fix available 5.3 MediumFebruary 8, 2021
• apostrophecms sanitize-html Improper Input Validation in sanitize-html CVE-2021-26539 Fix available 5.3 MediumFebruary 8, 2021
• apostrophecms sanitize-html Cross-Site Scripting in sanitize-html CVE-2016-1000237 Fix available 6.1 MediumJanuary 23, 2020