CVE-2026-113654 ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-113654?
CVE-2026-113654 is a medium-severity vulnerability in apostrophecms apostrophe, published on 20 Oct 2026.
Official description
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-113654?
2 open source packages ship an affected version, including sanitize-html.
| Package | Affected | Fixed in |
|---|---|---|
sanitize-html npm | All versions | 2.18.0 |
sanitize-html npm | All versions | 2.18.0 |
How do I fix CVE-2026-113654?
Upgrade sanitize-html to 2.18.0 or later.
Is CVE-2026-113654 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-113654 exists.
Sources
Also known as ECHO-2746-5d30-75b8, GHSA-x3q4-9hxx-gx8m.