UpHeron
All vulnerabilities

npm

CVE-2026-113650

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

Severity
Medium 5.3
Published
21 Oct 2026
Last changed
21 Oct 2026
Added to UpHeron
22 Oct 2026
Fixed in
2.18.1
Also known as
GHSA-c9rx-x947-fp3h
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
sanitize-htmlnpm · osv:npm:sanitize-html
  • From 2.18.0 before 2.18.1

References