ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script execution occurring when a user activates the affected link; the default sanitizer configuration is not unconditionally affected. This issue is fixed in sanitize-html 2.18.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple
    HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that
    permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the
    SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The
    bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script
    execution occurring when a user activates the affected link; the default sanitizer configuration is not
    unconditionally affected. This issue is fixed in sanitize-html 2.18.0. (CVE-2026-113657)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple     HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configuration that     permits namespace-prefixed SVG animation elements and the relevant URL-targeting attributes can bypass the     SMIL URL protection because prefixed tag names do not match the unprefixed animation-element check. The     bypass can rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, with script     execution occurring when a user activates the affected link; the default sanitizer configuration is not     unconditionally affected. This issue is fixed in sanitize-html 2.18.0. (CVE-2026-113657)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476741	Chainguard: unleash-fips: security update to 8.2.1-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	low
476741	Chainguard: unleash-fips: security update to 8.2.1-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	low
369048	Linux Distros Unpatched Vulnerability : CVE-2026-113657	Nessus	Misc.	Local	low
476359	SCA: security update for sanitize-html (GHSA-374f-7chj-9948)	Tenable Cloud Security	SCA Checks	Local	low
476359	SCA: security update for sanitize-html (GHSA-374f-7chj-9948)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2026-113657

low

Tenable Plugins

low

low

low

low

low