{"id":"ghsa-ghsa-374f-7chj-9948","seq":2410,"kind":"advisory","title":"ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)","url":"https://github.com/advisories/GHSA-374f-7chj-9948","permalink":"https://vulnpulse.app/items/ghsa-ghsa-374f-7chj-9948","summary":"影響: npm:sanitize-html >= 2.17.7, < 2.18.0 → 2.18.0\nSummary sanitize-html 2.17.7 introduced animatesUrlAttribute() to block SVG animation elements (animate, animateColor, animateMotion, animateTransform, set) when their attributeName targets a URL sink like href. However, this check is bypassed when the animation element uses a namespace prefix (e.g., svg:animate instead of animate). Root Cause The animatesUrlAttribute function (index.js, line ~832) checks svgAnimationTags.indexOf(name.toLowerCase()), where svgAnimationTags contains bare local n…","severity":"low","techs":["nodejs"],"cves":["CVE-2026-113657"],"tags":["GHSA-374f-7chj-9948","sanitize-html"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:21:19.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}