DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-53606: CVE-2026-53606: Stored Cross-Site Scripting (XSS) via Unsanitized URI-bearing Attributes in sanitize-html

#security #cve #cybersecurity

CVE-2026-53606: Stored Cross-Site Scripting (XSS) via Unsanitized URI-bearing Attributes in sanitize-html

Vulnerability ID: CVE-2026-53606
CVSS Score: 5.4
Published: 2026-07-31

An incomplete default configuration vulnerability in sanitize-html prior to version 2.17.5 allows remote attackers to execute arbitrary JavaScript code via crafted HTML payloads containing neglected URI-bearing attributes (e.g., action, formaction, data, xlink:href) that bypass input validation logic.

TL;DR

The sanitize-html library bypassed URI scheme validation for standard attributes such as 'action' or 'formaction' when customized configurations allowed them, enabling Stored Cross-Site Scripting.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS Severity: Medium (5.4)
  • EPSS Score: 0.00136
  • Impact: Stored Cross-Site Scripting (XSS)
  • Exploit Status: Proof of Concept
  • KEV Status: Not Listed

Affected Systems

  • Apostrophe CMS configurations running vulnerable dependencies
  • Any Node.js applications using sanitize-html with custom allowed tags and attributes configurations prior to 2.17.5
  • sanitize-html: < 2.17.5 (Fixed in: 2.17.5)

Code Analysis

Commit: 5a88e96

Fix incomplete allowedSchemesAppliedToAttributes array to prevent XSS through neglected URI-accepting HTML attributes

Exploit Details

Mitigation Strategies

  • Upgrade sanitize-html to version 2.17.5 or higher
  • Manually configure allowedSchemesAppliedToAttributes in older versions of the library to validate URI schemes on all URI-accepting elements

Remediation Steps:

  1. Identify all instances of sanitize-html imports in the application codebase
  2. Run 'npm install sanitize-html@2.17.5' or update the package dependency inside package.json
  3. If upgrading is blocked, declare custom options in sanitizeHtml calls to explicitly include attributes like action, formaction, and data in the allowedSchemesAppliedToAttributes list
  4. Enforce a Content Security Policy (CSP) to mitigate downstream impact in case of any future parsing discrepancies

References

Read the full report for CVE-2026-53606 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)