Vulnpedia
← Search CVEs

CVE-2026-113650

MEDIUM 5.3

Published 2026-10-20 · Last modified 2026-10-20

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 34th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

5.3CVSS 3.1 · MEDIUM

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityLow

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Apostrophecms

Products Apostrophe Sanitize Html

Weakness (CWE)

  • CWE-674: : Uncontrolled Recursion

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • sanitize-html npm

    pkg:npm/sanitize-html

    SEMVER range
    • Introduced version (included): 2.18.0
    • Fixed boundary (excluded): 2.18.1
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-c9rx-x947-fp3h/GHSA-c9rx-x947-fp3h.json"
  }
}
    GitHub Advisory Database · GHSA-c9rx-x947-fp3h · Updated 2026-10-21T17:15:08.634885273Z

Vendor product assessments

  • costmanagement/costmanagement-ui-rhel10 as a component of Cost Management On Premise · known affected

    Vendor assessment for this product only.

    pkg:oci/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d?repository_url=registry.redhat.io/costmanagement/costmanagement-ui-rhel10

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • multicluster-engine/console-mce-rhel9 as a component of Multicluster Engine for Kubernetes · known affected

    Vendor assessment for this product only.

    pkg:oci/console-mce-rhel9@sha256:e25a8cf699de55aafdc6b644bc4c1b3405abdff5b669509d990f449ad17b1f51?repository_url=registry.redhat.io/multicluster-engine/console-mce-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • rhacm2/console-rhel9 as a component of Red Hat Advanced Cluster Management for Kubernetes 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/console-rhel9@sha256:eea4b6716c64ce4cfee79fc2bbfbf744be82b31b9dc51a0623013fac56265294?repository_url=registry.redhat.io/rhacm2/console-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • cockpit-image-builder as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/cockpit-image-builder

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • cockpit-image-builder.src as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/cockpit-image-builder?arch=src

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • prometheus3.5.src as a component of Red Hat Hardened Images · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • no fix planned: Will not fix
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • rhoai/odh-mlflow-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-mlflow-rhel9@sha256:4191f9c06ee97bc01d3749155c7cf8eb24de213948ea3517bc195b505c1e799b?repository_url=registry.redhat.io/rhoai/odh-mlflow-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • openshift4/ose-agent-installer-ui-rhel9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-agent-installer-ui-rhel9@sha256:3c4e2bb4cab1817be07b8fb7f94bc884d8b5d30953c21c84339a412f303bc543?repository_url=registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • openshift4/ose-console as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-console@sha256:ae246b20d41e3463bb19180c11f75cb44b3dae3f3519aa97fe7ba24e07928270?repository_url=registry.redhat.io/openshift4/ose-console

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • openshift4/ose-console-rhel9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-console-rhel9@sha256:8638a1917f3ff065d34bd2529f093208fa5257d8fa621f2a42a95948ac2cb034?repository_url=registry.redhat.io/openshift4/ose-console-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • devspaces/dashboard-rhel9 as a component of Red Hat OpenShift Dev Spaces · known affected

    Vendor assessment for this product only.

    pkg:oci/dashboard-rhel9@sha256:bb5346516525fe025ae9cbf1fd3f227fb1cad71ae73ad58264a7e5ffb2931eb3?repository_url=registry.redhat.io/devspaces/dashboard-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • quay/quay-rhel8 as a component of Red Hat Quay 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee?repository_url=registry.redhat.io/quay/quay-rhel8

    • no fix planned: Out of support scope
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • quay/quay-rhel9 as a component of Red Hat Quay 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783?repository_url=registry.redhat.io/quay/quay-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • satellite/iop-advisor-frontend-rhel9 as a component of Red Hat Satellite 6 · known affected

    Vendor assessment for this product only.

    pkg:oci/iop-advisor-frontend-rhel9@sha256:5c98cd17bd4fe98b9a7f21b8dd285477e2262b53723351c607d957bfc422547c?repository_url=registry.redhat.io/satellite/iop-advisor-frontend-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • satellite/iop-host-inventory-frontend-rhel9 as a component of Red Hat Satellite 6 · known affected

    Vendor assessment for this product only.

    pkg:oci/iop-host-inventory-frontend-rhel9@sha256:7c39ecb6f63fa79890ec88707870eb2f665fa49de6e42eb5c41807044725933a?repository_url=registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • satellite/iop-vulnerability-frontend-rhel9 as a component of Red Hat Satellite 6 · known affected

    Vendor assessment for this product only.

    pkg:oci/iop-vulnerability-frontend-rhel9@sha256:059b28a4878677f15bd8ae0f591df8605df1a23a1d97c59ccfa1c9c0a9cd36df?repository_url=registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00
  • prometheus3.13.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-113650 · Updated 2026-10-22T21:28:51+00:00

All CVSS metrics

  • MEDIUM 5.3 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  • MEDIUM 5.3 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS