CVE-2026-113657 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-113657?
CVE-2026-113657 is a low-severity vulnerability in apostrophecms apostrophe, published on 20 Oct 2026.
Official description
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-113657?
2 open source packages ship an affected version, including sanitize-html.
| Package | Affected | Fixed in |
|---|---|---|
sanitize-html npm | From 2.17.7 | 2.18.0 |
sanitize-html npm | From 2.17.7 | 2.18.0 |
How do I fix CVE-2026-113657?
Upgrade sanitize-html to 2.18.0 or later.
Is CVE-2026-113657 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-113657 exists.
Sources
Also known as ECHO-bff4-095f-fba6, GHSA-374f-7chj-9948.