Apostrophecms Sanitize-html
10 CVEs affecting Apostrophecms Sanitize-html. Latest disclosed: 2026-06-12. Critical: 1, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44990 | Critical | 9.3 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default confi… |
CVE-2026-40186 | Medium | 6.1 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of the ApostropheCMS-… |
CVE-2014-125128 | Medium | 6.1 | 2025-09-08 | 'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (`h… |
CVE-2019-25225 | Medium | 6.1 | 2025-09-08 | `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content… |
CVE-2016-1000237 | Medium | 6.1 | 2020-01-23 | sanitize-html before 1.4.3 has XSS. |
CVE-2026-53606 | Medium | 5.4 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-ht… |
CVE-2024-21501 | Medium | 5.3 | 2024-02-24 | Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allow… |
CVE-2022-25887 | Medium | 5.3 | 2022-08-30 | The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement log… |
CVE-2021-26540 | Medium | 5.3 | 2021-02-08 | Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRel… |
CVE-2021-26539 | Medium | 5.3 | 2021-02-08 | Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostnam… |