UpHeron
All vulnerabilities

npm

CVE-2026-113654

ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

Severity
Medium
Published
20 Oct 2026
Last changed
20 Oct 2026
Added to UpHeron
20 Oct 2026
Fixed in
2.18.0
Also known as
GHSA-x3q4-9hxx-gx8m
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
sanitize-htmlnpm · osv:npm:sanitize-html
  • Every version before 2.18.0

References