https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 22:02:45 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-113650 <p>ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an &lt;iframe&gt; is not allowed and disallowedTagsMode is &#39;discard&#39; (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.</p> <p>ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an &lt;iframe&gt; is not allowed and disallowedTagsMode is &#39;discard&#39; (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-113650 https://db.gcve.eu/vuln/ghsa-c9rx-x947-fp3h <p><strong>Affected:</strong> npm: sanitize-html</p> <p>### Summary</p> <p>Since 2.18.0, when an `&lt;iframe&gt;` is not allowed and `disallowedTagsMode` is `&#39;discard&#39;` (the defaults), its raw-text content is re-sanitized by a recursive call to `sanitizeHtml(text, options)` (the change from #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state. Two consequences, both absent from 2.17.7 and 2.17.4:</p> <p>1. A few kilobytes of unclosed `&lt;iframe&gt;` tags throw `RangeError: Maximum call stack size exceeded` with the default options. Any application that sanitizes untrusted HTML with 2.18.0 can be made to throw on a small crafted input. 2. `nestingLimit` is not enforced across a discarded iframe: each nested iframe restarts the depth count at zero, so the output can be nested arbitrarily deep regardless of the configured limit.</p> <p>### Affected versions</p> <p>- 2.18.0 (the current `latest`), and the `main` branch at the time of writing (the recursive call is still in `packages/sanitize-html/index.js`, in the `ontext` handler, branch `tag === &#39;iframe&#39; &amp;&amp; !tagAllowed(tag) &amp;&amp; options.disallowedTagsMode === &#39;discard&#39;`). - Not affected: 2.17.7 and 2.17.4 (tested with the same inputs below).</p> <p>Tested with Node.js v26.7.0.</p> <p>### Reproduction 1: stack overflow with the default options</p> <p>```js const sanitizeHtml = require(&#39;sanitize-html&#39;);</p> <p>// with 2.18.0: sanitizeHtml(&#39;&lt;iframe&gt;&#39;.repeat(1000)); // 8,000 chars: returns &#39;&#39; sanitizeHtml(&#39;&lt;iframe&gt;&#39;.repeat(2000)); // 16,000 chars: throws RangeError: Maximum call stack siz…</p> <p><strong>Affected:</strong> npm: sanitize-html</p> <p>### Summary</p> <p>Since 2.18.0, when an `&lt;iframe&gt;` is not allowed and `disallowedTagsMode` is `&#39;discard&#39;` (the defaults), its raw-text content is re-sanitized by a recursive call to `sanitizeHtml(text, options)` (the change from #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state. Two consequences, both absent from 2.17.7 and 2.17.4:</p> <p>1. A few kilobytes of unclosed `&lt;iframe&gt;` tags throw `RangeError: Maximum call stack size exceeded` with the default options. Any application that sanitizes untrusted HTML with 2.18.0 can be made to throw on a small crafted input. 2. `nestingLimit` is not enforced across a discarded iframe: each nested iframe restarts the depth count at zero, so the output can be nested arbitrarily deep regardless of the configured limit.</p> <p>### Affected versions</p> <p>- 2.18.0 (the current `latest`), and the `main` branch at the time of writing (the recursive call is still in `packages/sanitize-html/index.js`, in the `ontext` handler, branch `tag === &#39;iframe&#39; &amp;&amp; !tagAllowed(tag) &amp;&amp; options.disallowedTagsMode === &#39;discard&#39;`). - Not affected: 2.17.7 and 2.17.4 (tested with the same inputs below).</p> <p>Tested with Node.js v26.7.0.</p> <p>### Reproduction 1: stack overflow with the default options</p> <p>```js const sanitizeHtml = require(&#39;sanitize-html&#39;);</p> <p>// with 2.18.0: sanitizeHtml(&#39;&lt;iframe&gt;&#39;.repeat(1000)); // 8,000 chars: returns &#39;&#39; sanitizeHtml(&#39;&lt;iframe&gt;&#39;.repeat(2000)); // 16,000 chars: throws RangeError: Maximum call stack siz…</p> https://db.gcve.eu/vuln/ghsa-c9rx-x947-fp3h