sanitize-html EUVD-2026-105209

Exploitation requires a NON-DEFAULT sanitize-html configuration that explicitly permits meta refresh elements along with their http-equiv and content attributes; default configurations are not affected. The attacker must also hold an account permitted to submit content (PR:L per the CVSS vector), and a victim must subsequently render the malicious content (UI:R). These factors - the non-default allow-list, required authenticated submission, and required victim interaction - collectively limit realistic exploitation to sites that have deliberately loosened the sanitizer's defaults.

This is a moderate-severity stored/reflected XSS (CWE-79) with a CVSS 3.1 base score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The network vector and low attack complexity are offset by three meaningful brakes: it requires some privilege (PR:L - an account able to submit content), it requires victim interaction (UI:R - someone must render the malicious content), and most importantly it only manifests under a NON-DEFAULT sanitize-html configuration that explicitly allows meta refresh elements plus their http-equiv and content attributes. No EPSS score was supplied, the CVE is not on the CISA KEV list, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The scope change (S:C) correctly reflects that a sanitizer bypass lets attacker content execute in the victim's browser context. Net: this is a real but conditional defense-in-depth issue, not a drop-everything priority - its blast radius is limited to deployments that have deliberately loosened the default allow-list to permit meta refresh. Note also a data caveat: the provided 'source code evidence' commit diff contains only CI workflow and documentation changes and does NOT show the actual sanitize-html fix, so the patch content could not be independently verified from the supplied diff.

On an ApostropheCMS instance whose sanitize-html allow-list has been customized to permit meta elements with http-equiv/content attributes, a low-privileged content contributor submits body content containing a meta refresh tag whose content value carries a javascript: or hostile redirect URL. When an administrator or another user later views that content, the retained refresh destination fires in their browser, enabling script execution or forced redirection. No public exploit code is identified at time of analysis.