ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

影響: npm:sanitize-html >= 2.18.0, < 2.18.1 → 2.18.1

Since 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options) (the change from #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state. Two consequences, both absent from 2.17.7 and 2.17.4: 1. A few kilobytes of unclosed tags throw RangeError: Maximum call stack size exceeded with the default options. Any application that sanitizes un…

GitHub Advisory Databaseで読む

2026/10/22 02:05、GitHub Advisory Databaseが「ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-113650。