ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

影響: npm:sanitize-html < 2.18.0 → 2.18.0

CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes (action, formaction, data, poster, background, later ping, xlink:href, …) go through naughtyHref(). A URL nested inside meta content (http-equiv=refresh) is not an attribute name on that list, so the embedded destination is never scheme-checked. Default allowedTags still omit meta. Same non-default integrator config as 53606: allow meta plus http-equiv / content. On 2.17.7: text sanitizeHtml( ' ', { allowe…

在 GitHub Advisory Database 阅读

2026/10/21 03:15，GitHub Advisory Database 发布了“ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js。CVE：CVE-2026-113661。