{"id":"ghsa-ghsa-x3q4-9hxx-gx8m","seq":2426,"kind":"advisory","title":"ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render","url":"https://github.com/advisories/GHSA-x3q4-9hxx-gx8m","permalink":"https://vulnpulse.app/items/ghsa-ghsa-x3q4-9hxx-gx8m","summary":"影響: npm:sanitize-html < 2.18.0 → 2.18.0\nSummary sanitize-html discards the content of every element in nonTextTags. It delimits that region using htmlparser2's close events, and ignores the isImplied flag htmlparser2 passes it. Closing a still-open ancestor from inside a makes htmlparser2 unwind its stack past the noscript; the synthetic implied close it emits on the way ends the discard region early, and everything after it is treated as ordinary body content. A browser with scripting enabled parses content as raw text, so the same…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-113654"],"tags":["GHSA-x3q4-9hxx-gx8m","sanitize-html"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:03:22.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}