Description
CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes (action, formaction, data, poster, background, later ping, xlink:href, …) go through naughtyHref().
Recommendation
Update the sanitize-html package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.18.0
- Patched version(s): 2.18.0
References
Could your website be exposed too?
SmartScanner can check your website for ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs and gives you actionable findings to investigate.
Start a free scanRelated Issues
- sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606
- ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) - CVE-2026-113657
- ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content rende - CVE-2026-113654
- ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, - CVE-2026-113650
You might also like:
See something that needs correcting? Let us knowUpdated October 20, 2026