CVE-2026-84371: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in apostrophecms apostrophe

ApostropheCMS uses the sanitize-html package to sanitize HTML content. From version 1.9.0 until 2.17.7, sanitize-html's validation of animation value attributes in SVG elements (such as animate, animateColor, animateMotion, animateTransform, and set) treats the values as a single flat URL and fails to recognize that attributes like href or xlink:href can have multiple sibling values with SVG SMIL URL semantics. This allows a crafted values list to start with a safe fragment but include a later executable destination that bypasses allowedSchemesAppliedToAttributes checks. When rendered, the browser may copy this executable destination into a live link, enabling script execution in the application's origin context. The vulnerability is addressed in sanitize-html version 2.17.7.

Successful exploitation can lead to cross-site scripting attacks, allowing an attacker to execute arbitrary scripts in the context of the vulnerable ApostropheCMS application. This can result in information disclosure or manipulation of the user interface. The CVSS score is 5.4 (medium), reflecting limited privileges required (low), user interaction needed (required), and partial impact on confidentiality and integrity.

This vulnerability is fixed in sanitize-html version 2.17.7. Users of ApostropheCMS should upgrade sanitize-html to version 2.17.7 or later to remediate this issue. No official vendor advisory or patch link is provided in the data, so users should verify the fix availability from the sanitize-html project or ApostropheCMS maintainers. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.