UpHeron
All vulnerabilities

npm

CVE-2026-113661

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

Severity
Medium 5.4
Published
20 Oct 2026
Last changed
20 Oct 2026
Added to UpHeron
20 Oct 2026
Fixed in
2.18.0
Also known as
GHSA-cv27-6wvh-8x7j
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
sanitize-htmlnpm · osv:npm:sanitize-html
  • Every version before 2.18.0

References