Vulnpedia
← Search CVEs

CVE-2026-113654

MEDIUM 5.3

Published 2026-10-20 · Last modified 2026-10-20

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 28th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

5.3CVSS 4.0 · MEDIUM

  • ConfidentialityLow
  • IntegrityLow
  • AvailabilityLow

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Apostrophecms

Products Apostrophe Sanitize Html

Weakness (CWE)

  • CWE-79: : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • sanitize-html npm

    pkg:npm/sanitize-html

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 2.18.0
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-x3q4-9hxx-gx8m/GHSA-x3q4-9hxx-gx8m.json"
  }
}
    GitHub Advisory Database · GHSA-x3q4-9hxx-gx8m · Updated 2026-10-20T18:15:04.513263654Z

Vendor product assessments

  • costmanagement/costmanagement-ui-rhel10 as a component of Cost Management On Premise · known affected

    Vendor assessment for this product only.

    pkg:oci/costmanagement-ui-rhel10@sha256:39700faac93e613fdd8139aed7b6dbb79a4d542f3f3cca6be04c4edce72eaf5d?repository_url=registry.redhat.io/costmanagement/costmanagement-ui-rhel10

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • multicluster-engine/console-mce-rhel9 as a component of Multicluster Engine for Kubernetes · known affected

    Vendor assessment for this product only.

    pkg:oci/console-mce-rhel9@sha256:e25a8cf699de55aafdc6b644bc4c1b3405abdff5b669509d990f449ad17b1f51?repository_url=registry.redhat.io/multicluster-engine/console-mce-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • rhacm2/console-rhel9 as a component of Red Hat Advanced Cluster Management for Kubernetes 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/console-rhel9@sha256:eea4b6716c64ce4cfee79fc2bbfbf744be82b31b9dc51a0623013fac56265294?repository_url=registry.redhat.io/rhacm2/console-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • cockpit-image-builder as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/cockpit-image-builder

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • cockpit-image-builder.src as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/cockpit-image-builder?arch=src

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • rhoai/odh-mlflow-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-mlflow-rhel9@sha256:4191f9c06ee97bc01d3749155c7cf8eb24de213948ea3517bc195b505c1e799b?repository_url=registry.redhat.io/rhoai/odh-mlflow-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • openshift4/ose-agent-installer-ui-rhel9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-agent-installer-ui-rhel9@sha256:3c4e2bb4cab1817be07b8fb7f94bc884d8b5d30953c21c84339a412f303bc543?repository_url=registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • openshift4/ose-console as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-console@sha256:ae246b20d41e3463bb19180c11f75cb44b3dae3f3519aa97fe7ba24e07928270?repository_url=registry.redhat.io/openshift4/ose-console

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • openshift4/ose-console-rhel9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-console-rhel9@sha256:8638a1917f3ff065d34bd2529f093208fa5257d8fa621f2a42a95948ac2cb034?repository_url=registry.redhat.io/openshift4/ose-console-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • devspaces/dashboard-rhel9 as a component of Red Hat OpenShift Dev Spaces · known affected

    Vendor assessment for this product only.

    pkg:oci/dashboard-rhel9@sha256:bb5346516525fe025ae9cbf1fd3f227fb1cad71ae73ad58264a7e5ffb2931eb3?repository_url=registry.redhat.io/devspaces/dashboard-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • quay/quay-rhel8 as a component of Red Hat Quay 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/quay-rhel8@sha256:f33464ccc07e05781c2ec093df7fd9093b5ab0aae6435c11d632cc1332a560ee?repository_url=registry.redhat.io/quay/quay-rhel8

    • no fix planned: Out of support scope
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • quay/quay-rhel9 as a component of Red Hat Quay 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/quay-rhel9@sha256:59726d934010c9215248cb30bd1ad084f03099c0138b8a3c2a3751b209683783?repository_url=registry.redhat.io/quay/quay-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • nodejs-sanitize-html.src as a component of Red Hat Satellite 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • satellite/iop-advisor-frontend-rhel9 as a component of Red Hat Satellite 6 · known affected

    Vendor assessment for this product only.

    pkg:oci/iop-advisor-frontend-rhel9@sha256:5c98cd17bd4fe98b9a7f21b8dd285477e2262b53723351c607d957bfc422547c?repository_url=registry.redhat.io/satellite/iop-advisor-frontend-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • satellite/iop-host-inventory-frontend-rhel9 as a component of Red Hat Satellite 6 · known affected

    Vendor assessment for this product only.

    pkg:oci/iop-host-inventory-frontend-rhel9@sha256:7c39ecb6f63fa79890ec88707870eb2f665fa49de6e42eb5c41807044725933a?repository_url=registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • satellite/iop-vulnerability-frontend-rhel9 as a component of Red Hat Satellite 6 · known affected

    Vendor assessment for this product only.

    pkg:oci/iop-vulnerability-frontend-rhel9@sha256:059b28a4878677f15bd8ae0f591df8605df1a23a1d97c59ccfa1c9c0a9cd36df?repository_url=registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9

    • none available: Fix deferred
    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00
  • prometheus3.13.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-113654 · Updated 2026-10-22T21:28:55+00:00

All CVSS metrics

  • MEDIUM 5.3 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
  • MEDIUM 5.3 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS