{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "apostrophecms sanitize-html: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/apostrophecms--sanitize-html/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/apostrophecms--sanitize-html/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113661/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113661/",
   "title": "CVE-2026-113661 · apostrophecms apostrophe · disclosed",
   "content_text": "ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This issue is fixed in sanitize-html 2.18.0.",
   "date_published": "2026-10-20T17:11:20Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113661/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113661/",
   "title": "CVE-2026-113661 · apostrophecms apostrophe · fixed in Chainguard (unleash 8.2.1-r1 and 1 more)",
   "content_text": "Fixed versions: unleash 8.2.1-r1, unleash-fips 8.2.1-r0.",
   "date_published": "2026-10-20T17:11:20Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113661/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113661/",
   "title": "CVE-2026-113661 · apostrophecms apostrophe · fixed upstream (npm)",
   "content_text": "Fixed versions: sanitize-html 2.18.0.",
   "date_published": "2026-10-20T17:11:20Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113657/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113657/",
   "title": "CVE-2026-113657 · apostrophecms apostrophe · disclosed",
   "content_text": "ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.",
   "date_published": "2026-10-20T16:54:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113657/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113657/",
   "title": "CVE-2026-113657 · apostrophecms apostrophe · fixed in Chainguard (unleash 8.2.1-r1 and 1 more)",
   "content_text": "Fixed versions: unleash 8.2.1-r1, unleash-fips 8.2.1-r0.",
   "date_published": "2026-10-20T16:54:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113657/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113657/",
   "title": "CVE-2026-113657 · apostrophecms apostrophe · fixed upstream (npm)",
   "content_text": "Fixed versions: sanitize-html 2.18.0.",
   "date_published": "2026-10-20T16:54:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113654/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113654/",
   "title": "CVE-2026-113654 · apostrophecms apostrophe · disclosed",
   "content_text": "ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.",
   "date_published": "2026-10-20T16:35:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113654/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113654/",
   "title": "CVE-2026-113654 · apostrophecms apostrophe · fixed in Chainguard (unleash 8.2.1-r1 and 1 more)",
   "content_text": "Fixed versions: unleash 8.2.1-r1, unleash-fips 8.2.1-r0.",
   "date_published": "2026-10-20T16:35:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113654/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113654/",
   "title": "CVE-2026-113654 · apostrophecms apostrophe · fixed upstream (npm)",
   "content_text": "Fixed versions: sanitize-html 2.18.0.",
   "date_published": "2026-10-20T16:35:55Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113650/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113650/",
   "title": "CVE-2026-113650 · apostrophecms apostrophe · disclosed",
   "content_text": "ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an \u003ciframe\u003e is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.",
   "date_published": "2026-10-20T16:19:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113650/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113650/",
   "title": "CVE-2026-113650 · apostrophecms apostrophe · fixed in Chainguard (librechat 0.8.8-r4 and 1 more)",
   "content_text": "Fixed versions: librechat 0.8.8-r4, saf 1.7.0-r4.",
   "date_published": "2026-10-20T16:19:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113650/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113650/",
   "title": "CVE-2026-113650 · apostrophecms apostrophe · fixed upstream (npm)",
   "content_text": "Fixed versions: sanitize-html 2.18.1.",
   "date_published": "2026-10-20T16:19:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113650/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113650/",
   "title": "CVE-2026-113650 · apostrophecms apostrophe · fixed in Wolfi (saf 1.7.0-r4)",
   "content_text": "Fixed versions: saf 1.7.0-r4.",
   "date_published": "2026-10-20T16:19:12Z"
  }
 ]
}