Bug 2488561 (CVE-2026-53606)

Summary:	CVE-2026-53606 apostrophecms sanitize-html: sanitize-html: Cross-Site Scripting (XSS) via insufficient URI scheme validation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abarbaro, adudiak, akhatavk, alcohan, alizardo, anjoseph, anthomas, aos-team-art-private, aruklets, asdas, bdettelb, cmyers, dkeler, dnakabaa, doconnor, dpaolell, ehelms, fdeutsch, ggainey, gparvin, jbalunas, jchui, jdelft, jhe, jkoehler, jpasqual, jprabhak, jupierce, juwatts, kaycoth, kshier, ktsao, lcouzens, lgarciaa, lphiri, mbiarnes, mdellweg, mhulan, nboldt, nmoumoul, oaljalju, oramraz, osousa, pahickey, pcreech, ppalepu, ppostler, prdhamdh, prwatson, psrna, rchan, rhaigner, sdawley, sdoran, sghai, sidsharm, smallamp, smullick, stcannon, stirabos, suppawar, teagle, thason, tmalecek, vlaad, wtam, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in sanitize-html, an HTML sanitizer library. This vulnerability allows a remote attacker to perform Cross-Site Scripting (XSS) attacks. The issue occurs because the sanitizer does not properly validate dangerous URI schemes, such as javascript:, when they are used in certain HTML attributes like action or data. This oversight enables an attacker to inject malicious scripts into web pages, which can then be executed in the victim's browser.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2495054, 2495055, 2495056, 2495058, 2495060, 2495061, 2495062, 2495065, 2495067, 2495070, 2495071, 2495053, 2495057, 2495059, 2495063, 2495069
Bug Blocks:

Description OSIDB Bzimport 2026-06-12 21:02:35 UTC

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-html prior to 2.17.5 use `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `naughtyHref()` function that blocks dangerous URI schemes like `javascript:` and `vbscript:`. The HTML specification defines 10+ attributes that accept URIs (`action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, `lowsrc`), but none of these are included in the default gate list. When a developer allows any of these attributes in their configuration, `javascript:` URIs pass through completely unmodified, enabling XSS. Version 2.17.5 patches the issue.