Description
When SVG animation is allowed, attributeName="href" makes values a list of URL destinations. sanitize-html accepts a list that starts with a safe fragment even when values is explicitly scheme-checked, allowing a later javascript: destination to execute when the sanitized link is activated.
Recommendation
Update the sanitize-html package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.9.0, <= 2.17.6
- Patched version(s): 2.17.7
References
Could your website be exposed too?
SmartScanner can check your website for ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass and gives you actionable findings to investigate.
Start a free scanRelated Issues
- ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) - CVE-2026-113657
- ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close - CVE-2026-63670
- Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme - CVE-2026-75510
- Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity - CVE-2026-31873
You might also like:
See something that needs correcting? Let us knowUpdated September 01, 2026