CVE-2026-113654: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in apostrophecms apostrophe

The vulnerability in ApostropheCMS stems from the sanitize-html library's handling of the noscript tag in versions prior to 2.18.0. When a non-default nonTextTags configuration includes noscript, the discard region can end early because htmlparser2 emits an implied ancestor close inside noscript. Browsers treat noscript content as raw text, but the parser does not model this mode, allowing content intended to be inert to survive sanitization and be rendered. This results in a cross-site scripting (CWE-79) vulnerability. The issue is resolved by upgrading sanitize-html to version 2.18.0 or later.

An attacker could exploit this vulnerability to inject malicious scripts that bypass sanitization filters, potentially leading to cross-site scripting attacks. This could allow execution of arbitrary scripts in the context of the affected web application, impacting confidentiality and integrity of user interactions. The CVSS 4.0 score is 5.3 (medium severity), indicating a moderate risk with network attack vector, low attack complexity, and no user interaction required.

Upgrade sanitize-html to version 2.18.0 or later to address the improper sanitization of the noscript tag. Additionally, upgrade ApostropheCMS to version 4.33.0 or later where this fix is incorporated. No other specific mitigations are indicated. Patch status is confirmed by the vendor advisory indicating the fix in sanitize-html 2.18.0.