5.3
Medium
CVE-2026-113650 ApostropheCMS is an open-source Node.js content management system
Description
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| apostrophe 4.34 | earliest → < 4.34.0 | 4.34.0 |
| sanitize-html 2.18 | 2.18.0 → < 2.18.1 | 2.18.1 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of apostrophe
The 51 CVEs of apostrophe →
CVE-2026-113711
ApostropheCMS is an open-source Node.js content management system
7.5
High
CVE-2026-113710
ApostropheCMS is an open-source Node.js content management system
5.9
Medium
CVE-2026-113671
ApostropheCMS is an open-source Node.js content management system
4.3
Medium
CVE-2026-113670
ApostropheCMS is an open-source Node.js content management system
5.3
Medium