sanitize-html CVE-2026-113654

Exploitable ONLY when sanitize-html is configured with a non-default nonTextTags option that explicitly includes the 'noscript' element; default configurations and other default nonTextTags elements are NOT affected. The attacker must be able to submit HTML content that is processed by the vulnerable sanitizer (in ApostropheCMS, a content-authoring role), and a victim must later view the stored content in a scripting-enabled browser. Limiting factors: the non-default configuration requirement sharply narrows the vulnerable population, exploitation requires low-privilege authentication (PR:L), and impact is limited to client-side script execution rather than server-side compromise.

This is a genuine but modest-severity (CVSS 4.0 base 5.3, Medium) stored XSS (CWE-79) in sanitize-html as consumed by ApostropheCMS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates network-reachable, low-complexity exploitation by a low-privileged (authenticated) actor with no user interaction, but only LOW impact to confidentiality, integrity, and availability - consistent with limited client-side script execution rather than server compromise. The single most important limiting signal is in the description itself: the flaw triggers ONLY under a non-default nonTextTags configuration that explicitly includes 'noscript', and the issue does not generalize to other default nonTextTags elements. No EPSS score, CISA KEV listing, or POC is present in the provided intelligence, so exploitation probability cannot be quantified; absence of these signals plus the non-default-config precondition argues this is a lower real-world priority than its library's popularity might suggest. Note a data conflict to verify: the CVSS vector sets VA:L (availability impact) for what is a content-sanitization/XSS bug where availability impact is dubious - treat the A/VA metric with skepticism. Prioritize patching for any deployment known to customize nonTextTags; otherwise this is a low-urgency hygiene update.

An ApostropheCMS (or other sanitize-html) deployment has customized nonTextTags to include noscript. A low-privileged content contributor submits crafted HTML where an htmlparser2 implied-ancestor close ends the noscript discard region early; the content that should have been stripped survives sanitization. When a scripting-enabled browser later renders the stored content, it treats the surviving noscript content as raw markup and executes attacker-controlled script in the victim's session. No public exploit code is identified at time of analysis.