CVE-2026-113661: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in apostrophecms apostrophe

ApostropheCMS uses the sanitize-html library to sanitize HTML content. Versions of sanitize-html before 2.18.0, when configured to allow meta refresh elements and their associated attributes, fail to properly neutralize unsafe scripts or redirect URLs embedded in the content attribute of meta refresh tags. This results in a cross-site scripting vulnerability (CWE-79) where malicious input can be executed in the context of the web page. The issue is resolved by updating sanitize-html to version 2.18.0 or later.

An attacker could exploit this vulnerability to execute arbitrary scripts or redirect users to malicious sites via crafted meta refresh elements. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session hijacking. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges and user interaction, and partial confidentiality and integrity impact without availability impact.

Upgrade the sanitize-html library to version 2.18.0 or later, which fixes the vulnerability by properly sanitizing meta refresh elements and their attributes. Since this is a library-level fix, ensure that ApostropheCMS installations update their dependencies accordingly. No other specific mitigations are indicated.