# CVE-2026-113657: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

Source: https://junglewise.ai/threats/cve-2026-113657-apostrophecms-is-an-open-source-node-js-content-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113657 · Severity: low · CVSS 3.7 · Published 2026-10-20

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.

Technologies: [sanitize-html (npm)](https://junglewise.ai/threats/technologies/sanitize-html). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-113657 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113657 being exploited in the wild.

**How severe is CVE-2026-113657?** Low severity, with a CVSS score of 3.7, published 20 October 2026.

**Which products and versions are affected?** sanitize-html (npm) >= 2.17.7, < 2.18.0, SEMVER:introduced=2.17.7,fixed=2.18.0.

**Is there a fix for CVE-2026-113657?** Yes. sanitize-html (npm): upgrade to 2.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-113657?** Check whether you run sanitize-html (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sanitize-html (npm): upgrade to 2.18.0 or later

  ```sh
  npm install sanitize-html@2.18.0
  ```


## Affected products

- sanitize-html (npm) >= 2.17.7, < 2.18.0, SEMVER:introduced=2.17.7,fixed=2.18.0

## Identifiers

- CVE-2026-113657
- GHSA-374f-7chj-9948

## Related threats

- [sanitize-html incomplete : meta refresh URL scheme bypass](https://junglewise.ai/threats/cve-2026-113661-apostrophecms-incomplete-meta-http-equiv-refresh-content-still)
- [sanitize-html noscript XSS bypass](https://junglewise.ai/threats/cve-2026-113654-apostrophecms-is-an-open-source-node-js-content-management)
- [sanitize-html unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-113650-apostrophecms-is-an-open-source-node-js-content-management)
- [sanitize-html stored XSS via SVG SMIL URI-list scheme bypass](https://junglewise.ai/threats/cve-2026-84371-sanitize-html-stored-xss-via-svg-smil-uri-list-scheme-bypass)
- [sanitize-html XSS bypass via textarea solidus close tag](https://junglewise.ai/threats/cve-2026-63670-sanitize-html-xss-bypass-via-textarea-solidus-close-tag)