Description

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that attributeName selecting href or xlink:href gives the sibling values, from, to, or by attribute SVG SMIL URL semantics. In configurations that allow the animate, animateColor, animateMotion, animateTransform, or set elements, a values list can begin with a safe fragment and contain a later executable destination that survives allowedSchemesAppliedToAttributes checking. When the sanitized SVG is rendered, the browser can copy that later destination into the live link, and a victim who activates the link can execute script in the application's origin. This issue is fixed in version 2.17.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-01T21:18:48.357Z",
  "pubdate": "2026-09-01T21:18:48.357Z",
  "executiveSummary": "The vulnerability resides in the sanitize-html library, specifically affecting how it processes SVG SMIL animation attributes. An improper validation logic fails to correctly parse the attributeName attribute when targeting href or xlink:href values within SMIL elements such as animate or set.\nThis flaw allows an attacker to bypass the library's URL sanitization mechanisms. By crafting a specific values list that begins with a benign fragment, an attacker can append a malicious executable destination that effectively evades the allowedSchemesAppliedToAttributes check.\nWhen a victim interacts with the rendered SVG, the browser's rendering engine may promote the malicious URL to a live link, resulting in a cross-site scripting (XSS) condition executed within the application's origin.\nThe vulnerability impacts ApostropheCMS and any other application utilizing sanitize-html versions 1.9.0 through 2.17.6. Successful exploitation requires the application configuration to permit the use of SVG animation elements. The risk is significant as it facilitates unauthorized script execution, potentially leading to session hijacking, data exfiltration, or further client-side compromise.",
  "technicalDetails": "The root cause of this vulnerability lies in an incomplete parsing logic within packages/sanitize-html/index.js. The sanitizer fails to account for the complex interaction between SMIL (Synchronized Multimedia Integration Language) attributes and URL validation. Specifically, it treats the animation value attribute as a flat URL, overlooking that when the attributeName attribute is set to href or xlink:href, the subsequent attributes—from, to, or by—function as sibling URL values.\nThe exploitation flow begins when an attacker injects a specially crafted SVG document into the content management system. Within this SVG, the attacker utilizes animation elements such as animate, animateColor, animateMotion, animateTransform, or set. By exploiting the logic gap, the attacker defines a values attribute list where the initial entry is a safe, permitted fragment that passes the sanitize-html validation routine. However, the subsequent entries in the values list contain an executable payload—such as a javascript: URI—that the sanitizer fails to inspect during the initial validation pass.\nBecause the sanitizer does not recognize the relationship between the target attribute and the SMIL values, the malicious URI is not stripped or blocked. Once the SVG is processed and rendered by the client's browser, the browser's native SMIL engine interprets the values list. If the rendering process triggers a link update, the browser copies the malicious URI from the values list into the active link. When a victim subsequently activates or interacts with the rendered element, the browser executes the payload in the context of the application's origin, thereby bypassing security policies.\nThe vulnerability exists in all sanitize-html versions from 1.9.0 up to 2.17.7. The flaw highlights a critical deficiency in how URI-based sanitization handles contextual attributes within SVG animation frameworks. As the payload is executed on the client-side, it operates with the privileges of the victim's session, enabling actions including unauthorized API calls, modification of DOM elements, or credential theft. The mitigation requires an update to the sanitizer to ensure it performs deep inspection of SMIL-related attributes and their associated values lists."
}