CVE-2026-113657: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in apostrophecms apostrophe

ApostropheCMS uses the sanitize-html library to sanitize HTML content. Between versions 2.17.7 and 2.18.0 of sanitize-html, an application configuration that permits namespace-prefixed SVG animation elements and related URL-targeting attributes can bypass the SMIL URL protection mechanism. This bypass occurs because prefixed tag names do not match the unprefixed animation-element check, allowing an attacker to rewrite a link destination to an unsafe URI. When the sanitized SVG is rendered, script execution can occur if a user activates the affected link. The default sanitizer configuration is not always affected. The issue is resolved in sanitize-html 2.18.0.

The vulnerability allows an attacker to craft SVG content that, after sanitization, can contain unsafe URIs leading to cross-site scripting when users interact with the affected links. This can result in limited confidentiality and integrity impacts due to script execution in the context of the affected web application. The CVSS score of 3.7 reflects a low severity with network attack vector, high attack complexity, low privileges required, and user interaction needed.

Upgrade sanitize-html to version 2.18.0 or later, where this vulnerability is fixed. Review application configurations that permit namespace-prefixed SVG animation elements and URL-targeting attributes to ensure they do not allow unsafe URIs. Since the default sanitizer configuration is not unconditionally affected, verify if your configuration is impacted and adjust accordingly.