ApostropheCMS: Incomplete CVE-2026-53606: meta http-equiv=refresh content still ships javascript: / data: URLs

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.4 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

• CVE-2026-113661: 0.26% estimated exploitation activity in the next 30 days; percentile 18.16 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes (action, formaction, data, poster, background, later ping, xlink:href, …) go through naughtyHref(). A URL nested inside meta content (http-equiv=refresh) is not an attribute name on that list, so the embedded destination is never scheme-checked. Default allowedTags still omit meta. Same non-default integrator config as 53606: allow meta plus http-equiv / content. On 2.17.7: data:text/html,… and arbitrary https: destinations also survive. formaction="javascript:…" (53606) is stripped. Please Request CVE. Credit: Finder + Reporter (adrbogacz). Details naughtyHref() only runs when the attribute name is in allowedSchemesAppliedToAttributes (index.js ~385). Refresh URLs live in a content value of the form 0;url=…, so the gate never fires. Adding content to that list wholesale would break ordinary meta content (description, viewport). Fix: when http-equiv is refresh (case-insensitive), parse the ;…

Published by the source

20 Oct 2026, 18:15 UTC

Last modified by the source

20 Oct 2026, 18:30 UTC

Source last checked

26 Oct 2026, 13:07 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-cv27-6wvh-8x7j

2. Revision 2 · amended · 24 Oct 2026

   Amended from osv record GHSA-cv27-6wvh-8x7j

3. Revision 1 · created · 23 Oct 2026

   Published from ghsa record GHSA-cv27-6wvh-8x7j

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-113661

Advisory: ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
IDs: CVE-2026-113661, GHSA-cv27-6wvh-8x7j
Record: https://patchnext.com/advisories/cve-2026-113661 (revision 3, source checked 26 Oct 2026, 13:07 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.4)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: sanitize-html 2.18.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm sanitize-html: affected < 2.18.0; fixed in 2.18.0

## Suggested inspection (read-only)
- `npm ls sanitize-html --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on sanitize-html.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-cv27-6wvh-8x7j (GitHub-reviewed advisory GHSA-cv27-6wvh-8x7j lists affected ranges: npm sanitize-html >=0 <2.18.0)
- Verified: https://osv.dev/vulnerability/GHSA-cv27-6wvh-8x7j (OSV record GHSA-cv27-6wvh-8x7j lists affected ranges: npm sanitize-html >=0 <2.18.0 (fixed))

Commands are suggestions: review each one before running it.