---
id: "CVE-2026-113654"
kind: "vulnerability"
aliases: ["CVE-2026-113654", "GHSA-x3q4-9hxx-gx8m"]
title: "ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render"
severity: "medium"
cvss: 5.3
epss: 0.003490000031888485
exploited: false
status: "open"
category: "package"
products: [{"name": "sanitize-html", "fixed": ["2.18.0"], "affected": "< 2.18.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-79", "node", "npm", "package", "sanitize-html", "user-generated-html", "web-apps"]
not_affected_if: ["no-user-html-input", "output-not-rendered-as-html", "version-2.18.0-or-later"]
published_at: "2026-10-20T17:17:36+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:20+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-x3q4-9hxx-gx8m", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113654", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

sanitize-html discards element content for tags listed in nonTextTags, but a crafted <noscript> with an implied close ends that discard region early, so markup after it is passed through. An attacker can get elements such as img beacons or links into sanitized output that a browser with scripting enabled would show as inert text, which enables markup injection (CWE-79).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:sanitize-html affected < 2.18.0 fixed 2.18.0

## How to check

Run npm ls sanitize-html and check whether the version is below 2.18.0.
Test sanitizeHtml('<div><noscript></div><img src="http://evil.test/t.gif"></noscript>', {allowedTags:["div","img"],allowedAttributes:{img:["src"]},nonTextTags:["script","style","textarea","option","noscript"]}) and see whether an img tag is returned.

## Fix

Upgrade sanitize-html to 2.18.0 or later.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-x3q4-9hxx-gx8m
- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113654

## From the sources

## Summary

`sanitize-html` discards the *content* of every element in `nonTextTags`. It delimits that region
using htmlparser2's close events, and ignores the `isImplied` flag htmlparser2 passes it. Closing a
still-open **ancestor** from inside a `<noscript>` makes htmlparser2 unwind its stack past the
`noscript`; the synthetic implied close it emits on the way ends the discard region early, and
everything after it is treated as ordinary body content.

A browser with scripting enabled parses `<noscript>` content as **raw text**, so the same markup
renders as inert text there. The sanitizer therefore emits elements the page itself would not have.

## Reproduction

```js
const sanitizeHtml = require("sanitize-html");

sanitizeHtml('<div><noscript></div><img src="http://evil.test/t.gif"></noscript>', {
  allowedTags: ["div", "img"],
  allowedAttributes: { img: ["src"] },
  nonTextTags: ["script", "style", "textarea", "option", "noscript"],
});
// => '<div></div><img src="http://evil.test/t.gif" />'
```

Chrome, given the same input, renders **no** `<img>` — the whole payload is raw text inside the
unclosed `<noscript>`. Verified with Playwright, `srcdoc` into an iframe so the scripting flag is on.

A `<![CDATA[` variant hides the opening tag from the parser entirely and has the same effect:

```
<p>Hi</p><![CDATA[ x > <noscript>]]><a href="…">Reset your password</a><img src="…beacon.gif"></noscript>
```

htmlparser2 runs a CDATA token to `]]>`; Chrome ends a bogus comment at the first `>`, so the
`<noscript>` after it is real to the browser and invisible to the parser.

## Where the behaviour is

`index.js`:

- `:154` — `nonTextTagsArray` (the default list, `['script','style','textarea','option','xmp']`).
- `:638` — `onclosetag: function (name, isImplied)` — receives the flag.
- `:644` — `skipTextDepth--` — decrements without consulting `isImplied`.

## Suggested fix

Do not end a discard region on an implied close. htmlparser2 already distinguishes them; the flag
is passed and discarded. Something close to:

```js
onclosetag: function (name, isImplied) {
  if (skipText) {
    if (isImplied) return;   // an implied close must not end the region
    skipTextDepth--;
    …
```

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_