https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 09:15:21 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-113654 <p>ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.</p> <p>ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render; the issue does not generalize to every default nonTextTags element. This issue is fixed in sanitize-html 2.18.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-113654 https://db.gcve.eu/vuln/ghsa-x3q4-9hxx-gx8m <p><strong>Affected:</strong> npm: sanitize-html</p> <p>## Summary</p> <p>`sanitize-html` discards the *content* of every element in `nonTextTags`. It delimits that region using htmlparser2&#39;s close events, and ignores the `isImplied` flag htmlparser2 passes it. Closing a still-open **ancestor** from inside a `&lt;noscript&gt;` makes htmlparser2 unwind its stack past the `noscript`; the synthetic implied close it emits on the way ends the discard region early, and everything after it is treated as ordinary body content.</p> <p>A browser with scripting enabled parses `&lt;noscript&gt;` content as **raw text**, so the same markup renders as inert text there. The sanitizer therefore emits elements the page itself would not have.</p> <p>## Reproduction</p> <p>```js const sanitizeHtml = require(&#34;sanitize-html&#34;);</p> <p>sanitizeHtml(&#39;&lt;div&gt;&lt;noscript&gt;&lt;/div&gt;&lt;img src=&#34;http://evil.test/t.gif&#34;&gt;&lt;/noscript&gt;&#39;, { allowedTags: [&#34;div&#34;, &#34;img&#34;], allowedAttributes: { img: [&#34;src&#34;] }, nonTextTags: [&#34;script&#34;, &#34;style&#34;, &#34;textarea&#34;, &#34;option&#34;, &#34;noscript&#34;], }); // =&gt; &#39;&lt;div&gt;&lt;/div&gt;&lt;img src=&#34;http://evil.test/t.gif&#34; /&gt;&#39; ```</p> <p>Chrome, given the same input, renders **no** `&lt;img&gt;` — the whole payload is raw text inside the unclosed `&lt;noscript&gt;`. Verified with Playwright, `srcdoc` into an iframe so the scripting flag is on.</p> <p>A `&lt;![CDATA[` variant hides the opening tag from the parser entirely and has the same effect:</p> <p>``` &lt;p&gt;Hi&lt;/p&gt;&lt;![CDATA[ x &gt; &lt;noscript&gt;]]&gt;&lt;a href=&#34;…&#34;&gt;Reset your password&lt;/a&gt;&lt;img src=&#34;…beacon.gif&#34;&gt;&lt;/noscript&gt; ```</p> <p>htmlparser2 runs a CDATA token to `]]&gt;`; Chrome ends a bogus comment at t…</p> <p><strong>Affected:</strong> npm: sanitize-html</p> <p>## Summary</p> <p>`sanitize-html` discards the *content* of every element in `nonTextTags`. It delimits that region using htmlparser2&#39;s close events, and ignores the `isImplied` flag htmlparser2 passes it. Closing a still-open **ancestor** from inside a `&lt;noscript&gt;` makes htmlparser2 unwind its stack past the `noscript`; the synthetic implied close it emits on the way ends the discard region early, and everything after it is treated as ordinary body content.</p> <p>A browser with scripting enabled parses `&lt;noscript&gt;` content as **raw text**, so the same markup renders as inert text there. The sanitizer therefore emits elements the page itself would not have.</p> <p>## Reproduction</p> <p>```js const sanitizeHtml = require(&#34;sanitize-html&#34;);</p> <p>sanitizeHtml(&#39;&lt;div&gt;&lt;noscript&gt;&lt;/div&gt;&lt;img src=&#34;http://evil.test/t.gif&#34;&gt;&lt;/noscript&gt;&#39;, { allowedTags: [&#34;div&#34;, &#34;img&#34;], allowedAttributes: { img: [&#34;src&#34;] }, nonTextTags: [&#34;script&#34;, &#34;style&#34;, &#34;textarea&#34;, &#34;option&#34;, &#34;noscript&#34;], }); // =&gt; &#39;&lt;div&gt;&lt;/div&gt;&lt;img src=&#34;http://evil.test/t.gif&#34; /&gt;&#39; ```</p> <p>Chrome, given the same input, renders **no** `&lt;img&gt;` — the whole payload is raw text inside the unclosed `&lt;noscript&gt;`. Verified with Playwright, `srcdoc` into an iframe so the scripting flag is on.</p> <p>A `&lt;![CDATA[` variant hides the opening tag from the parser entirely and has the same effect:</p> <p>``` &lt;p&gt;Hi&lt;/p&gt;&lt;![CDATA[ x &gt; &lt;noscript&gt;]]&gt;&lt;a href=&#34;…&#34;&gt;Reset your password&lt;/a&gt;&lt;img src=&#34;…beacon.gif&#34;&gt;&lt;/noscript&gt; ```</p> <p>htmlparser2 runs a CDATA token to `]]&gt;`; Chrome ends a bogus comment at t…</p> https://db.gcve.eu/vuln/ghsa-x3q4-9hxx-gx8m