PatchSiren cyber security CVE debrief
CVE-2026-53606 apostrophecms CVE debrief
CVE-2026-53606 is a vulnerability in the sanitize-html package, used by ApostropheCMS, a Node.js content management system. The vulnerability arises from the `allowedSchemesAppliedToAttributes` configuration, which by default does not include all HTML attributes that accept URIs. This oversight enables `javascript:` URIs to pass through unmodified, potentially leading to Cross-Site Scripting (XSS) attacks when developers allow certain attributes in their configuration. The issue was patched in version 2.17.5 of sanitize-html.
- Vendor
- apostrophecms
- Product
- sanitize-html
- CVSS
- MEDIUM 5.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-12
- Original CVE updated
- 2026-06-15
- Advisory published
- 2026-06-12
- Advisory updated
- 2026-06-15
Who should care
Developers and administrators using ApostropheCMS and the sanitize-html package should be aware of this vulnerability. Specifically, those who have customized the `allowedSchemesAppliedToAttributes` configuration in sanitize-html might be at risk if they have allowed attributes that accept URIs not included in the default gate list.
Technical summary
The sanitize-html package, prior to version 2.17.5, does not properly gate against dangerous URI schemes like `javascript:` and `vbscript:` for all HTML attributes that accept URIs. The package uses `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to determine which attributes to protect. However, the HTML specification defines over 10 attributes that accept URIs, including `action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, and `lowsrc`, which are not all included in the default protection list. This omission allows `javascript:` URIs to bypass sanitization when developers configure their applications to allow these attributes, potentially leading to XSS attacks.
Defensive priority
MEDIUM
Recommended defensive actions
- Update sanitize-html to version 2.17.5 or later.
- Review and adjust the `allowedSchemesAppliedToAttributes` configuration to ensure it includes all relevant attributes that accept URIs.
- Implement additional security measures to detect and prevent XSS attacks, such as Content Security Policy (CSP) and regular security audits.
Evidence notes
CVE-2026-53606 has a CVSS score of 5.4 and is classified as MEDIUM severity. It was published and modified on June 12, 2026. The vulnerability is related to CWE-79, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Sources and references
Verified primary and authoritative sources
-
CVE-2026-53606 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-53606
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-53606 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53606
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vccv-cmxp-4j9h
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.