CVE-2026-113661 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS and sanitize-html installations should assess exposure and update to mitigate potential security risks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and update sanitize-html to version 2.18.0 or later. They should review and update ApostropheCMS to ensure compatibility with the updated sanitize-html version and assess and update any affected

Why it matters

Defenders should prioritize verifying and updating sanitize-html to version 2.18.0 or later to address potential security risks associated with meta refresh elements in ApostropheCMS.

• Potential security risks due to unsafe script or redirect destinations in meta refresh content
• Need for verification and updates to sanitize-html and ApostropheCMS

Technical summary

The sanitize-html library used in ApostropheCMS had a vulnerability that allowed unsafe script or redirect destinations in meta refresh content. This issue is fixed in sanitize-html version 2.18.0. Defenders should prioritize verifying and updating sanitize-html to version 2.18.0 or later to address potential security risks associated with meta refresh elements in ApostropheCMS. The vulnerability impacts non-default configurations that allow meta refresh elements and their http-equiv and content attributes. Verification and updates to sanitize-html and ApostropheCMS are necessary.

Defensive priority

Defenders should prioritize verifying and updating sanitize-html to version 2.18.0 or later to address potential security risks associated with meta refresh elements.

Recommended defensive actions

• Verify and update sanitize-html to version 2.18.0 or later
• Review and update ApostropheCMS to ensure compatibility with the updated sanitize-html version
• Assess and update any affected systems or applications using ApostropheCMS and sanitize-html
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in sanitize-html, which is used in ApostropheCMS. The issue allows non-default configurations to retain unsafe script or redirect destinations in meta refresh content. Defenders should verify and update sanitize-html to version 2.18.0 or later. The CVE record was published on 2026-10-20T17:11:20.577Z and has not been modified since then. Evidence limits and source grounding indicate potential security risks due to unsafe script or redirect destinations in meta refresh

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.