CVE-2026-53606: sanitize-html XSS Vulnerability

CVE-2026-53606 Overview

CVE-2026-53606 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the sanitize-html library used by ApostropheCMS, an open-source Node.js content management system. Versions of sanitize-html prior to 2.17.5 fail to gate dangerous URI schemes across the full set of HTML attributes that accept URIs. The naughtyHref() function blocks schemes such as javascript: and vbscript:, but only for attributes listed in allowedSchemesAppliedToAttributes (default: href, src, cite). Attributes like action, formaction, data, poster, background, ping, xlink:href, dynsrc, and lowsrc are not gated. Version 2.17.5 patches the issue.

Critical Impact
When a developer configures sanitize-html to allow any ungated URI-bearing attribute, attackers can inject javascript: URIs that pass through unmodified, enabling client-side script execution in victim browsers.

Affected Products

sanitize-html versions prior to 2.17.5
ApostropheCMS deployments that depend on vulnerable sanitize-html versions
Any Node.js application using sanitize-html with non-default allowedSchemesAppliedToAttributes configurations

Discovery Timeline

2026-06-12 - CVE-2026-53606 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53606

Vulnerability Analysis

The vulnerability resides in how sanitize-html applies its URI scheme allowlist. The library exposes the allowedSchemesAppliedToAttributes option, which defaults to ['href', 'src', 'cite']. Only these three attributes invoke naughtyHref(), the function responsible for stripping dangerous schemes such as javascript:, vbscript:, and data:.

The HTML specification defines more than ten attributes that accept URI values. These include action and formaction on form elements, data on <object>, poster on <video>, background on <body> and tables, ping on anchors, xlink:href in SVG, and legacy dynsrc and lowsrc. None of these appear in the default gate list.

When a developer extends allowedAttributes to permit any of these URI-bearing attributes without also adding them to allowedSchemesAppliedToAttributes, the sanitizer accepts javascript: payloads verbatim. The resulting HTML executes script in the rendering browser.

Root Cause

The root cause is an incomplete allowlist. The maintainers gated three commonly known URI attributes but did not enumerate the full set defined by the HTML specification. The mismatch between user-configurable allowedAttributes and the hard-coded scheme-check scope creates an unsafe default for any extended configuration.

Attack Vector

Exploitation requires an authenticated low-privilege user with content-editing permissions and a victim user interaction to render the malicious markup. The attacker submits HTML containing a permitted URI attribute, for example <form action="javascript:alert(document.cookie)"> or <object data="javascript:...">, through any field processed by the vulnerable sanitize-html configuration. When a victim views the rendered content, the script executes in their browser context, enabling session theft, content manipulation, or further client-side attacks. The scope-changed impact reflects script execution crossing trust boundaries within the application.

No verified public proof-of-concept code is referenced in the advisory. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-53606

Indicators of Compromise

HTML content stored in the CMS containing javascript:, vbscript:, or data:text/html values in attributes such as action, formaction, poster, data, background, ping, or xlink:href.
Outbound browser requests to attacker-controlled domains originating from authenticated CMS sessions during page rendering.
Unexpected modifications to user profiles or content created via authenticated XHR calls following content views.

Detection Strategies

Audit stored CMS content for URI-scheme strings in non-href/src/cite attributes using database or content-export grep queries.
Inspect deployed sanitize-html configurations for allowedAttributes entries that include URI-bearing attributes without matching allowedSchemesAppliedToAttributes entries.
Run Software Composition Analysis (SCA) to identify sanitize-html versions below 2.17.5 across Node.js dependency trees.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture script-src violations triggered by injected inline handlers.
Log and review content-submission events from low-privileged editors for HTML payloads containing suspicious URI schemes.
Monitor web server access logs for atypical referrer chains following content publication by new or untrusted accounts.

How to Mitigate CVE-2026-53606

Immediate Actions Required

Upgrade sanitize-html to version 2.17.5 or later across all Node.js services, including transitive dependencies pulled in by ApostropheCMS.
Review every sanitize-html configuration in the codebase and explicitly set allowedSchemesAppliedToAttributes to include every URI-bearing attribute permitted by allowedAttributes.
Purge or re-sanitize stored content authored before the patch to remove any persisted javascript: payloads.

Patch Information

The maintainers fixed the vulnerability in sanitize-html version 2.17.5 by extending the gate list to cover the full set of URI-accepting HTML attributes. Refer to the GitHub Security Advisory GHSA-vccv-cmxp-4j9h for upgrade and remediation details.

Workarounds

Restrict allowedAttributes in sanitize-html configurations to attributes that do not accept URIs until the upgrade is deployed.
If extended attributes are required, manually add action, formaction, data, poster, background, ping, xlink:href, dynsrc, and lowsrc to allowedSchemesAppliedToAttributes.
Deploy a strict Content Security Policy that disallows inline script execution and restricts script sources to trusted origins.

bash

# Upgrade sanitize-html to the patched version
npm install sanitize-html@^2.17.5

# Verify resolved version across the dependency tree
npm ls sanitize-html