## ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-113654
- 公開日時: 2026-10-20T18:03:22.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-x3q4-9hxx-gx8m)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-x3q4-9hxx-gx8m

影響: npm:sanitize-html < 2.18.0 → 2.18.0
Summary sanitize-html discards the content of every element in nonTextTags. It delimits that region using htmlparser2's close events, and ignores the isImplied flag htmlparser2 passes it. Closing a still-open ancestor from inside a makes htmlparser2 unwind its stack past the noscript; the synthetic implied close it emits on the way ends the discard region early, and everything after it is treated as ordinary body content. A browser with scripting enabled parses content as raw text, so the same…