@apostrophecms sanitize-html

• CVE-2026-113661 Medium 5.4 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs 0.3%
• CVE-2026-113657 Low 3.7 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) 0.3%
• CVE-2026-113654 Medium 5.3 ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render 0.4%
• CVE-2026-113650 Medium 5.3 ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) 0.5%
• CVE-2026-53606 Medium 5.4 sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes 0.2%
• CVE-2026-44990 Critical 9.3 Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` 0.7%
• CVE-2026-40186 Medium 6.1 ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements 0.2%