CVE-2026-113654 in sanitize-html
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified involves a logic error within the sanitize-html library, specifically affecting versions prior to 2.18.0 when used with ApostropheCMS or any Node.js application relying on this sanitization engine for HTML processing. The core issue stems from a discrepancy between how web browsers interpret noscript elements and how the underlying htmlparser2 parser models them during the sanitization process. In standard browser environments, content nested within a noscript tag is treated as raw text rather than executable markup, effectively neutralizing any scripts or tags contained therein. However, the sanitizer relies on an implied ancestor close mechanism triggered by htmlparser2 that does not account for this scripting-enabled context. When the configuration includes nonTextTags such as noscript, the parser prematurely ends the discard region intended to strip dangerous content. This misalignment allows malicious payloads embedded within these elements to survive the sanitization process and be rendered in the final output, bypassing security controls designed to prevent cross-site scripting attacks.
From a technical perspective, this flaw represents a failure in input validation logic where the sanitizer fails to maintain strict isolation of potentially hazardous HTML structures under specific configuration states. The vulnerability is categorized under CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting. By allowing inert content intended for display rather than execution to be interpreted and rendered by the browser, the application exposes users to potential script injection attacks if an attacker can control or influence the input data processed through this vulnerable version of sanitize-html. The issue is not universal across all nonTextTags configurations but specifically impacts scenarios where noscript elements are included in the list of tags that should have their content discarded or strictly controlled during sanitization operations.
The operational impact of this vulnerability allows attackers to potentially execute arbitrary JavaScript code within the context of a victim user's browser session if they can inject HTML containing malicious scripts wrapped in noscript tags into an application using the affected library version. This could lead to unauthorized access, data theft, or defacement depending on the sensitivity of the information handled by the ApostropheCMS instance or other applications utilizing sanitize-html. Security teams must recognize that even elements typically considered safe due to their inert nature can become vectors for attack if the parsing logic incorrectly handles implied closures and discard regions.
To mitigate this risk, organizations should immediately upgrade the sanitize-html dependency to version 2.18.0 or later where the handling of noscript tags has been corrected to align with browser behavior regarding raw text interpretation. Additionally, developers implementing content management systems should enforce strict Content Security Policy headers to provide an additional layer of defense against script execution even if sanitization fails. Regular auditing of third-party dependencies and their configuration settings is essential to ensure that non-default configurations do not introduce unexpected parsing behaviors that could compromise application security posture.