Is CVE-2026-113654 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113654 being exploited in the wild.

How severe is CVE-2026-113654?

Medium severity, with a CVSS score of 4, published 20 October 2026.

Which products and versions are affected?

Jfm Sanitize-Html prior to 2.18.0; sanitize-html (npm) < 2.18.0, SEMVER:introduced=0,fixed=2.18.0.

Is there a fix for CVE-2026-113654?

Yes. sanitize-html (npm): upgrade to 2.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113654 attacked?

It is attacked over the network.

Am I affected by CVE-2026-113654?

Check whether you run Jfm Sanitize-Html or sanitize-html (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113654: sanitize-html noscript XSS bypass

Q: Is there a fix for CVE-2026-113654?

Yes. sanitize-html (npm): upgrade to 2.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-113654 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-113654?

Check whether you run Jfm Sanitize-Html or sanitize-html (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113654 · Severity: medium · CVSS 4 · Published 2026-10-20

sanitize-html is a library that removes potentially dangerous HTML from user-supplied content, protecting applications from cross-site scripting (XSS) attacks. When using a non-default configuration that treats noscript as a non-text tag, the sanitizer can incorrectly end its filtering region early, allowing malicious scripts to survive sanitization and execute in browsers where JavaScript is enabled, bypassing the intended security filter.

Technologies: sanitize-html (npm). Vendors: npm.

Quick answers

Is CVE-2026-113654 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113654 being exploited in the wild.
How severe is CVE-2026-113654?: Medium severity, with a CVSS score of 4, published 20 October 2026.
Which products and versions are affected?: Jfm Sanitize-Html prior to 2.18.0; sanitize-html (npm) < 2.18.0, SEMVER:introduced=0,fixed=2.18.0.
Is there a fix for CVE-2026-113654?: Yes. sanitize-html (npm): upgrade to 2.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113654 attacked?: It is attacked over the network.
Am I affected by CVE-2026-113654?: Check whether you run Jfm Sanitize-Html or sanitize-html (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sanitize-html (npm): upgrade to 2.18.0 or later
```
npm install sanitize-html@2.18.0
```

Technical details

The vulnerability exists in sanitize-html prior to 2.18.0 when htmlparser2 emits an implied ancestor close tag inside a noscript element with non-default nonTextTags configuration. Because scripting-enabled browsers treat noscript content as raw text (not parsed as markup), but the parser does not model this raw-text mode correctly, content intended to remain inert can render as active markup. The fix in 2.18.0 ensures the discard region continues until the actual closing noscript tag, regardless of intermediate ancestor closes.

Affected products

jfm sanitize-html prior to 2.18.0

Identifiers

CVE-2026-113654
GHSA-x3q4-9hxx-gx8m

Timeline

2026-10-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.