CVE-2026-113654 apostrophecms CVE debrief

Who should care

Defenders responsible for maintaining systems that utilize the sanitize-html package, particularly those that handle user-supplied content, should be aware of this vulnerability and take steps to verify and mitigate potential exposure.

Why it matters

The sanitize-html package vulnerability allows certain markup to be treated as ordinary body content rather than raw text, potentially resulting in unintended content being displayed. Defenders should prioritize verifying the versions of sanitize-html in use and assessing the exposure of systems that utilize this package.

• Defenders must verify the versions of sanitize-html in use and assess the exposure of systems that utilize this package.
• Unintended content may be displayed due to incorrect handling of non-text tags.
• Defensive measures should be adjusted to monitor for potential exploitation attempts.

Technical summary

The sanitize-html package incorrectly handles content within non-text tags, such as <noscript>, allowing certain markup to be treated as ordinary body content rather than raw text. This can lead to the sanitizer emitting elements that a browser would not render, potentially resulting in unintended content being displayed. The issue arises when an ancestor of a <noscript> element is closed, causing the discard region for non-text tags to end prematurely. Defenders should prioritize verifying the versions of sanitize-html in use and assessing the exposure of systems that utilize this package, particularly those that handle user-supplied content.

Defensive priority

Defenders should prioritize verifying the versions of sanitize-html in use and assessing the exposure of systems that utilize this package, particularly those that handle user-supplied content.

Recommended defensive actions

• Verify the version of sanitize-html in use and update to 2.18.0 or later if necessary.
• Assess the exposure of systems that utilize this package, particularly those that handle user-supplied content.
• Review and adjust the configuration of sanitize-html to ensure proper handling of non-text tags.
• Monitor for potential exploitation attempts and adjust defensive measures accordingly.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including a summary, reproduction code, and references to related commits and releases. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.