ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow,

Description

Since 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options) (the change from #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state. Two consequences, both absent from 2.17.

Recommendation

Update the sanitize-html package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.18.0, < 2.18.1
• Patched version(s): 2.18.1

References

• GHSA-c9rx-x947-fp3h
• CVE-2026-113650
• CWE-674
• CAPEC-310