Description
sanitize-html 2.17.7 introduced animatesUrlAttribute() to block SVG animation elements (animate, animateColor, animateMotion, animateTransform, set) when their attributeName targets a URL sink like href. However, this check is bypassed when the animation element uses a namespace prefix (e.g., svg:animate instead of animate).
Recommendation
Update the sanitize-html package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.17.7, < 2.18.0
- Patched version(s): 2.18.0
References
Could your website be exposed too?
SmartScanner can check your website for ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass - CVE-2026-84371
- sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606
- CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS - CVE-2026-26028
- ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, - CVE-2026-113650
You might also like:
See something that needs correcting? Let us knowUpdated October 20, 2026