CVE-2026-113657 in sanitize-html
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified within the sanitize-html library, specifically affecting versions from 2.17.7 through 2.18.0, represents a significant security flaw rooted in how HTML sanitization rules are applied to SVG elements. Sanitize-html is widely utilized by content management systems like ApostropheCMS to strip dangerous attributes and tags from user-supplied HTML, thereby preventing Cross-Site Scripting attacks. The core issue arises when the library's configuration allows for namespace-prefixed SVG animation elements while simultaneously enforcing URL-targeting attribute restrictions. In standard XML and SVG contexts, namespaces are used to distinguish between different sets of element definitions. However, the sanitization logic in these vulnerable versions fails to correctly map prefixed tag names against the unprefixed checks designed to block dangerous SMIL (Synchronized Multimedia Integration Language) animation elements that can execute JavaScript via URL attributes such as xlink:href or href when triggered by user interaction.
This logical discrepancy allows an attacker to bypass the intended security controls by utilizing namespace-prefixed variants of SVG animation tags, such as animateTransform or set with specific namespace declarations. Because the sanitization routine checks for unprefixed element names like animate or set but does not account for their prefixed counterparts in certain configuration states, these elements are permitted into the sanitized output. Once rendered in a browser environment, if an attacker can control the content of these SVG animations and link them to malicious URIs, they can exploit the SMIL URL execution capabilities. This effectively transforms what should be static or safe visual data into a vector for script execution when a user interacts with the affected element, such as by clicking on it or triggering specific animation events.
The operational impact of this vulnerability is severe in contexts where untrusted content is sanitized and then rendered to other users. An attacker could craft malicious SVG payloads that appear benign but contain hidden links pointing to phishing sites or servers hosting additional malware. When a victim views the page containing the sanitized yet vulnerable SVG, their browser may execute arbitrary JavaScript code under the context of the website's origin. This leads to potential session hijacking, data exfiltration, defacement, or further exploitation of backend systems if cookies and local storage are accessible. It is important to note that this bypass relies on specific configuration choices within sanitize-html; applications using default sanitizer configurations may not be unconditionally affected because they typically do not permit the namespace-prefixed SVG animation elements required for this attack vector to succeed.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific mechanism involves failing to properly validate or sanitize input that results in the execution of scripts via SMIL animations within SVG content. In terms of adversary tactics, this flaw facilitates techniques associated with ATT&CK ID T1059, specifically command and scripting interpreter abuse through browser-based vectors like JavaScript. It also relates to CWE-829 for inclusion of functionality from untrusted control sector if the namespace handling is viewed as a trust boundary failure. The vulnerability underscores the complexity of sanitizing complex markup languages where attribute inheritance and namespace resolution can create unexpected bypass paths in security filters.
To mitigate this risk, organizations relying on sanitize-html must immediately upgrade to version 2.18.0 or later, which addresses the logic error by ensuring that prefixed animation elements are subject to the same strict URL-targeting restrictions as their unprefixed counterparts. For applications unable to update instantly due to dependency constraints, a temporary mitigation involves reviewing custom sanitizer configurations to ensure that no namespace-prefixed SVG animation tags are explicitly allowed in the whitelist of permitted tags. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting script execution origins and preventing inline scripts from running even if they are successfully injected into the DOM. Regular audits of third-party library dependencies and their configuration settings are essential to maintain a robust security posture against evolving web-based attack vectors.