Product by Apostrophe

    ApostropheCMS sanitize-html

    14 known vulnerabilities in ApostropheCMS sanitize-html (Apostrophe), 0 of them actively exploited (CISA KEV).

    Key figures

    14

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in ApostropheCMS sanitize-html (Apostrophe)
    CriticalCVE-2026-44990

    Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

    		9.3
    MediumCVE-2021-26539

    ApostropheCMS sanitize-html: security vulnerability

    		5.3
    MediumCVE-2021-26540

    ApostropheCMS sanitize-html: security vulnerability

    		5.3
    HighCVE-2022-25887

    Regular Expression Denial of Service (ReDoS)

    		5.3
    MediumCVE-2026-113650

    Apostrophe: Uncontrolled Recursion

    also in 1 other product

    		5.3
    MediumCVE-2026-113654

    Apostrophe: Cross-site Scripting

    also in 1 other product

    		—
    MediumCVE-2024-21501

    Sanitize-html: Exposure of Sensitive Information to an Unauthorized Actor

    also in 1 other product

    		5.3
    MediumCVE-2026-113661

    Apostrophe: Cross-site Scripting

    also in 1 other product

    		5.4
    MediumCVE-2016-1000237

    ApostropheCMS sanitize-html: Cross-Site Scripting (XSS)

    		6.1
    LowCVE-2026-113657

    Apostrophe: Cross-site Scripting

    also in 1 other product

    		3.7
    MediumCVE-2026-40186

    ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements

    also in 3 other products

    		6.1
    MediumCVE-2026-53606

    ApostropheCMS sanitize-html: Cross-site Scripting

    also in 1 other product

    		5.4
    MediumCVE-2014-125128

    Sanitize-html: Cross-site Scripting

    		6.1
    MediumCVE-2019-25225

    Sanitize-html: Cross-site Scripting

    		6.1

    News

    All products by Apostrophe