CVE-2026-113650 apostrophecms CVE debrief

Who should care

Defenders handling untrusted HTML input in applications using sanitize-html 2.18.0 should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who may be impacted by the potential stack overflow errors and arbitrary nesting of HTML elements.

Why it matters

CVE-2026-113650 is a vulnerability in the sanitize-html library that allows for unbounded recursion, leading to potential stack overflow errors and arbitrary nesting of HTML elements. Defenders should prioritize assessment and remediation of this vulnerability in applications using sanitize-html 2.18.0.

• Potential stack overflow errors
• Arbitrary nesting of HTML elements
• Denial of Service (DoS) via crafted input
• Possible security bypass due to lack of nesting limit enforcement

Technical summary

The sanitize-html library versions 2.18.0 is vulnerable to an unbounded recursion issue when an iframe is discarded. This can lead to a stack overflow error with a small crafted input. The issue arises from the recursive call to sanitizeHtml(text, options) without enforcing a nesting limit, allowing for arbitrary nesting of HTML elements. The issue is fixed in version 2.18.1. Defenders should prioritize assessment and remediation of this vulnerability in applications using sanitize-html 2.18.0, particularly those handling untrusted HTML input.

Defensive priority

Defenders should prioritize assessment and remediation of this vulnerability in applications using sanitize-html 2.18.0, particularly those handling untrusted HTML input.

Recommended defensive actions

• Assess exposure in applications using sanitize-html 2.18.0
• Verify if applications handle untrusted HTML input
• Remediate by updating to sanitize-html 2.18.1 or later
• Monitor for potential stack overflow errors
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by an unbounded recursive call to sanitizeHtml(text, options) when an iframe is discarded. This can lead to a stack overflow error with a small crafted input. The issue is fixed in version 2.18.1. Evidence is limited to public statements from the vendor and affected users. Defenders should verify if applications handle untrusted HTML input and monitor for potential stack overflow errors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.