{"action":"Upgrade sanitize-html to 2.18.0 or later.","affected":[{"fixed":"2.18.0","introduced":"2.17.7"}],"component":"sanitize-html","cve_ids":["CVE-2026-113657"],"ecosystem":"npm","exploited":false,"fixed_versions":["2.18.0"],"ghsa_id":"GHSA-374f-7chj-9948","id":"tcs_01M5JK8DB1EDRXF0GBFNDDAFCV","modified_at":"2026-10-20T18:30:03.591034807Z","published_at":"2026-10-20T18:21:19Z","references":["https://osv.dev/vulnerability/GHSA-374f-7chj-9948","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-374f-7chj-9948","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe","https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-374f-7chj-9948","url":"https://osv.dev/vulnerability/GHSA-374f-7chj-9948"}],"summary":"ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)"}