CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
Stored XSS in ApostropheCMS allows script execution via SVG SMIL attributes when animation elements are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-84371?
CVE-2026-84371 is a medium-severity cross-site scripting vulnerability in apostrophecms apostrophe, published on 1 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that attributeName selecting href or xlink:href gives the sibling values, from, to, or by attribute SVG SMIL URL semantics. In configurations that allow the animate, animateColor, animateMotion, animateTransform, or set elements, a values list can begin with a safe fragment and contain a later executable destination that survives allowedSchemesAppliedToAttributes checking. When the sanitized SVG is rendered, the browser can copy that later destination into the live link, and a victim who activates the link can execute script in the application's origin. This issue is fixed in version 2.17.7.
Weakness: CWE-79
Which versions are affected by CVE-2026-84371?
2 open source packages ship an affected version, including sanitize-html.
| Package | Affected | Fixed in |
|---|---|---|
sanitize-html npm | From 1.9.0 | 2.17.7 |
sanitize-html npm | From 1.9.0 | 2.17.7 |
How do I fix CVE-2026-84371?
Upgrade sanitize-html to 2.17.7 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-84371 being exploited?
There is no known exploitation of CVE-2026-84371 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-LG36939, CLSA-2026-1788517172, ECHO-bd72-1c82-327f, GHSA-g8qq-57p8-ggw5, MINI-2jf4-jpmp-2ph2, MINI-555r-9x7w-9g7q and 2 more.