## ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-113661
- 公開日時: 2026-10-20T18:15:33.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-cv27-6wvh-8x7j)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-cv27-6wvh-8x7j

影響: npm:sanitize-html < 2.18.0 → 2.18.0
Summary CVE-2026-53606 expanded allowedSchemesAppliedToAttributes so named URL attributes (action, formaction, data, poster, background, later ping, xlink:href, …) go through naughtyHref(). A URL nested inside meta content (http-equiv=refresh) is not an attribute name on that list, so the embedded destination is never scheme-checked. Default allowedTags still omit meta. Same non-default integrator config as 53606: allow meta plus http-equiv / content. On 2.17.7: text sanitizeHtml( ' ', { allowe…