Executive brief
A popular HTML sanitization library used in CMS platforms and web editors fails to block malicious 'javascript:' links in certain HTML attributes like form actions and media posters. While the default settings are safe, developers who customize the library to allow forms or advanced media elements may inadvertently allow attackers to execute malicious scripts in users' browsers. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
The sanitize-html library uses a hardcoded list, 'allowedSchemesAppliedToAttributes', to determine which attributes should undergo URI scheme validation via the 'naughtyHref()' function. By default, this list only includes 'href', 'src', and 'cite'. If a developer configures the library to allow other URI-bearing attributes defined in the HTML specification (such as 'action', 'formaction', 'data', 'poster', or 'background'), the library fails to check them for dangerous schemes like 'javascript:'. An attacker can provide input containing these attributes to execute arbitrary JavaScript when a user interacts with the resulting HTML (e.g., submitting a form). This issue is resolved in version 2.17.5 by expanding the default validation list.
Affected products
- ApostropheCMS sanitize-html >= 1.18.0, <= 2.17.4
Timeline
- 2026-06-11: disclosed
- 2026-07-31: advisory
- 2026-07-31: patched
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vccv-cmxp-4j9h
- https://github.com/apostrophecms/apostrophe/pull/5464
- https://github.com/apostrophecms/apostrophe/commit/5a88e9630cbbdde33154ef8abe7557ddf7be418b
- https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.17.5
- https://api.github.com/repos/apostrophecms/apostrophe/security-advisories/GHSA-vccv-cmxp-4j9h