CVE-2026-113654: sanitize-html Package Vulnerability Allows <noscript> Content to Render Improperly
Summary
CVE-2026-113654: ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting. Affects sanitize-html versions < 2.18.0. Fixed in 2.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sanitize-html package is a popular library in the npm ecosystem that allows developers to sanitize HTML content to prevent XSS (Cross-Site Scripting) attacks. It provides a way to specify allowed tags and attributes, ensuring that only safe HTML is rendered in web applications. However, a vulnerability has been identified that affects how the library handles certain HTML tags, particularly <noscript>, which can lead to unintended content being rendered.
Vulnerability Detail
The vulnerability arises from the way sanitize-html processes non-text tags. Specifically, it improperly discards content within <noscript> tags due to an early termination of the discard region when an implied close occurs. This flaw allows potentially harmful content, such as images from untrusted sources, to be rendered in the browser, which would normally be treated as inert text. As a result, users may be exposed to security risks, including XSS attacks, if the sanitized output is not as expected.
How To Fix
Latest published version: 2.18.1 as of 23 Oct 2026
npm install sanitize-html@2.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.18.0
This is the first release that contains the fix.
npm install sanitize-html@2.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider implementing a workaround by avoiding the use of <noscript> tags in your HTML content or by manually sanitizing any content that may be included within these tags to ensure it does not contain harmful elements.
Conclusion
The CVE-2026-113654 vulnerability in the sanitize-html package poses a significant risk by allowing potentially harmful content to be rendered due to improper handling of <noscript> tags. It is crucial for developers to update to the patched version 2.18.0 or later to ensure the security of their applications. Additionally, utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for sanitize-html →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. By simply analyzing your package-lock.json file, Vulert can help you determine if your application is affected.
The primary risk is that malicious content could be rendered in the browser, leading to XSS attacks, which can compromise user data and application integrity.
Yes, you can manually sanitize <noscript> content by ensuring that it does not include any potentially harmful HTML elements or attributes before rendering it.
If an immediate update is not possible, consider implementing a workaround by avoiding <noscript> tags or sanitizing their content manually to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for sanitize-html.
