{"id":"ghsa-ghsa-cv27-6wvh-8x7j","seq":2416,"kind":"advisory","title":"ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs","url":"https://github.com/advisories/GHSA-cv27-6wvh-8x7j","permalink":"https://vulnpulse.app/items/ghsa-ghsa-cv27-6wvh-8x7j","summary":"影響: npm:sanitize-html < 2.18.0 → 2.18.0\nSummary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes (action, formaction, data, poster, background, later ping, xlink:href, …) go through naughtyHref(). A URL nested inside meta content (http-equiv=refresh) is not an attribute name on that list, so the embedded destination is never scheme-checked. Default allowedTags still omit meta. Same non-default integrator config as 53606: allow meta plus http-equiv / content. On 2.17.7: text sanitizeHtml( ' ', { allowe…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-113661"],"tags":["GHSA-cv27-6wvh-8x7j","sanitize-html"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:15:33.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}