Description
sanitize-html discards the content of every element in nonTextTags. It delimits that region using htmlparser2’s close events, and ignores the isImplied flag htmlparser2 passes it.
Recommendation
Update the sanitize-html package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.18.0
- Patched version(s): 2.18.0
References
Could your website be exposed too?
SmartScanner can check your website for ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content rende and gives you actionable findings to investigate.
Start a free scanRelated Issues
- ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) - CVE-2026-113657
- ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, - CVE-2026-113650
- sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements - CVE-2026-40186
- ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs - CVE-2026-113661
You might also like:
See something that needs correcting? Let us knowUpdated October 20, 2026