{"id":"CVE-2026-113657","aliases":["GHSA-374f-7chj-9948"],"title":"ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)","summary":"ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)","severity":"low","cvss":3.7,"cwe":["CWE-79"],"vendor":"sanitize-html","product":"sanitize-html","ecosystem":"npm","affected":["sanitize-html >= 2.17.7, < 2.18.0"],"patched":["sanitize-html 2.18.0"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T18:21:20Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-374f-7chj-9948","references":[{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-374f-7chj-9948"},{"url":"https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"},{"url":"https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"},{"url":"https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0"},{"url":"https://github.com/advisories/GHSA-374f-7chj-9948"}],"tags":["ghsa","npm","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T17:07:42.782981Z"},"ingestedAt":"2026-10-20T17:12:53.597Z","slug":"CVE-2026-113657","body":"## Overview\n\n## Summary\n\nsanitize-html 2.17.7 introduced `animatesUrlAttribute()` to block SVG animation elements (`animate`, `animateColor`, `animateMotion`, `animateTransform`, `set`) when their `attributeName` targets a URL sink like `href`. However, this check is bypassed when the animation element uses a namespace prefix (e.g., `svg:animate` instead of `animate`).\n\n## Root Cause\n\nThe `animatesUrlAttribute` function (index.js, line ~832) checks `svgAnimationTags.indexOf(name.toLowerCase())`, where `svgAnimationTags` contains bare local names: `[\"animate\", \"animatecolor\", \"animatemotion\", \"animatetransform\", \"set\"]`. htmlparser2 passes namespace-prefixed tag names verbatim, so `svg:animate` does not match `animate` in the array, causing the function to return `false` and skip the SMIL XSS protection.\n\nIronically, the function already handles namespace prefixes correctly for the `attributeName` target value (line ~843): `const localName = target.slice(target.lastIndexOf(\":\") + 1)` — but this same stripping was not applied to the tag name itself.\n\n## Proof of Concept\n\n```javascript\nconst sanitizeHtml = require(\"sanitize-html\");\n\nconst config = {\n  allowedTags: false,\n  allowedAttributes: false,\n  allowedSchemes: [\"http\", \"https\"]\n};\n\n// Standard animate — BLOCKED by 2.17.7 fix\nconst blocked = sanitizeHtml(\n  `<svg><a href=\"#safe\"><animate attributeName=\"href\" values=\"#safe;javascript:alert(1)\" dur=\".01s\" fill=\"freeze\"/><text>Click</text></a></svg>`,\n  config\n);\nconsole.log(\"Standard animate:\", blocked.includes(\"javascript:\") ? \"BYPASS\" : \"BLOCKED\");\n// Output: BLOCKED\n\n// Namespace-prefixed animate — BYPASSES the fix\nconst bypassed = sanitizeHtml(\n  `<svg><a href=\"#safe\"><svg:animate attributeName=\"href\" values=\"#safe;javascript:alert(document.domain)\" dur=\".01s\" fill=\"freeze\"/><text>Click</text></a></svg>`,\n  config\n);\nconsole.log(\"svg:animate:\", bypassed.includes(\"javascript:\") ? \"BYPASS\" : \"BLOCKED\");\n// Output: BYPASS\n```\n\nAll 5 SMIL animation elements are bypassable with any namespace prefix (`svg:`, `xlink:`, `xml:`, uppercase variants). Tested and confirmed on sanitize-html 2.17.7 from the apostrophe monorepo.\n\n## Impact\n\nCross-site scripting (XSS) via SMIL animation retargeting. When an application uses `allowedTags: false` (common in rich-text editors that want to preserve SVG), an attacker can inject `<svg:animate attributeName=\"href\" values=\"#safe;javascript:...\" .../>` to override the `href` attribute of a parent `<a>` element after the page loads, causing the link to execute JavaScript when clicked.\n\n## Suggested Fix\n\nStrip the namespace prefix from the tag name before the lookup, matching the pattern already used for the attribute name target:\n\n```javascript\n// Before (vulnerable):\nif (svgAnimationTags.indexOf(name.toLowerCase()) === -1) {\n\n// After (fixed):\nconst localTagName = name.toLowerCase().slice(name.lastIndexOf(\":\") + 1);\nif (svgAnimationTags.indexOf(localTagName) === -1) {\n```\n\n## Affected Versions\n\nsanitize-html >= 2.17.7 (where the SMIL animation protection was introduced). Earlier versions lack the SMIL protection entirely.\n\n## Credit\n\nKai Aizen (SnailSploit) — Adversarial AI & Security Research\n\n## Affected packages\n\n- `sanitize-html >= 2.17.7, < 2.18.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `sanitize-html 2.18.0`","depth":"twilight","depthScore":32,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":226060,"id":"CVE-2026-113657","ts":1792520132743,"field":"exploit_available","old":"false","new":"true"}]}