UpHeron
All vulnerabilities

npm

CVE-2026-113657

ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

Severity
Low 3.7
Published
20 Oct 2026
Last changed
20 Oct 2026
Added to UpHeron
20 Oct 2026
Fixed in
2.18.0
Also known as
GHSA-374f-7chj-9948
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
sanitize-htmlnpm · osv:npm:sanitize-html
  • From 2.17.7 before 2.18.0

References