The sanitize-html library used by ApostropheCMS versions before 2.17.5 improperly neutralizes input during web page generation by not applying URI scheme restrictions to all HTML attributes that accept URIs. Specifically, attributes such as action, formaction, data, poster, background, ping, xlink:href, dynsrc, and lowsrc are not included in the default allowedSchemesAppliedToAttributes list. When developers permit these attributes, dangerous URI schemes like javascript: can pass through unmodified, resulting in cross-site scripting vulnerabilities. The issue is fixed in version 2.17.5.

This vulnerability allows an attacker to inject malicious javascript: URIs into HTML attributes that are not properly sanitized, potentially leading to cross-site scripting attacks. Such attacks can result in limited confidentiality and integrity impacts, including execution of arbitrary scripts in the context of the affected web application. The CVSS 3.1 base score is 5.4 (medium severity) reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and partial confidentiality and integrity impact without availability impact.

Upgrade sanitize-html to version 2.17.5 or later, where this vulnerability is patched. No other mitigations are indicated or recommended by the vendor advisory. Patch status is not explicitly stated but the version 2.17.5 is identified as the fixed version.