CVE-2026-113650 | Vulnetix

CVE-2026-113650 PUBLISHED CVSS 5.3 MEDIUM

Reported by github_m · Published October 20, 2026

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.

Risk scores

CVSS 3.1

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Vendor	Product	Versions
apostrophecms	apostrophe	< 4.34.0
apostrophecms	sanitize-html	>= 2.18.0, < 2.18.1
apostrophecms	sanitize-html	2.18.0
chainguard	saf	0
npm	sanitize-html	2.18.0
wolfi	saf	0
chainguard	librechat	0
apostrophecms	apostrophe	0

Timeline

Oct 20, 2026 CVE Published
Oct 21, 2026 EPSS Score (6 in total, the first dated here)
Oct 28, 2026 CVE Updated
Oct 31, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-113650
vulnetix vdb fixes CVE-2026-113650

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-113650/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-c9rx-x947-fp3h x_refsource_CONFIRM
https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498 x_refsource_MISC
https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea x_refsource_MISC
https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.1 x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2026-113650 advisory
https://github.com/advisories/GHSA-c9rx-x947-fp3h advisory

Look up in the Resolve Platform →