PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53606 apostrophecms CVE debrief

CVE-2026-53606 is a vulnerability in the sanitize-html package, used by ApostropheCMS, a Node.js content management system. The vulnerability arises from the `allowedSchemesAppliedToAttributes` configuration, which by default does not include all HTML attributes that accept URIs. This oversight enables `javascript:` URIs to pass through unmodified, potentially leading to Cross-Site Scripting (XSS) attacks when developers allow certain attributes in their configuration. The issue was patched in version 2.17.5 of sanitize-html.

Vendor
apostrophecms
Product
sanitize-html
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-15
Advisory published
2026-06-12
Advisory updated
2026-06-15

Who should care

Developers and administrators using ApostropheCMS and the sanitize-html package should be aware of this vulnerability. Specifically, those who have customized the `allowedSchemesAppliedToAttributes` configuration in sanitize-html might be at risk if they have allowed attributes that accept URIs not included in the default gate list.

Technical summary

The sanitize-html package, prior to version 2.17.5, does not properly gate against dangerous URI schemes like `javascript:` and `vbscript:` for all HTML attributes that accept URIs. The package uses `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to determine which attributes to protect. However, the HTML specification defines over 10 attributes that accept URIs, including `action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, and `lowsrc`, which are not all included in the default protection list. This omission allows `javascript:` URIs to bypass sanitization when developers configure their applications to allow these attributes, potentially leading to XSS attacks.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update sanitize-html to version 2.17.5 or later.
  • Review and adjust the `allowedSchemesAppliedToAttributes` configuration to ensure it includes all relevant attributes that accept URIs.
  • Implement additional security measures to detect and prevent XSS attacks, such as Content Security Policy (CSP) and regular security audits.

Evidence notes

CVE-2026-53606 has a CVSS score of 5.4 and is classified as MEDIUM severity. It was published and modified on June 12, 2026. The vulnerability is related to CWE-79, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Sources and references

Verified primary and authoritative sources

  • CVE-2026-53606 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-53606

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-53606 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53606

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.