CVE-2026-113650— ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
Quick assessment
Affected
apostrophecms apostrophe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ApostropheCMS 是一个开源的 Node.js 内容管理系统。在 sanitize-html 2.18.0 版本中，当 标签被禁止且 设置为 （默认配置）时，其原始文本内容会通过递归调用 再次进行清理。该递归调用没有终止条件，且每次嵌套调用都会从全新的状态开始。此漏洞已在 2.18.1 版本中修复。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| apostrophecms | apostrophe | < 4.34.0 |
affected |
| apostrophecms | sanitize-html | >= 2.18.0, < 2.18.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-113650
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
Source: CVE Program / CVE List V5
Vulnerability Description
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| apostrophecms | apostrophe | < 4.34.0 | - |
|
| apostrophecms | sanitize-html | >= 2.18.0, < 2.18.1 | - |
|
II. Public POCs for CVE-2026-113650
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-113650
请登录查看更多情报信息。
Other References for CVE-2026-113650 (3)
Same Patch Batch · apostrophecms · 2026-10-20 · 33 CVEs total
| CVE-2026-113711 | 7.5 HIGH | ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing i |
| CVE-2026-113658 | 7.5 HIGH | ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system te |
| CVE-2026-113666 | 7.1 HIGH | ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophe |
| CVE-2026-113653 | 6.9 MEDIUM | ApostropheCMS: The general public can access @apostrophecms/user objects via a relationshi |
| CVE-2026-112956 | 6.5 MEDIUM | ApostropheCMS: Archive duplicate continuation lets contributors overwrite published conten |
| CVE-2026-112955 | 6.5 MEDIUM | ApostropheCMS: Import archives can exhaust server storage and deny service |
| CVE-2026-113649 | 6.5 MEDIUM | ApostropheCMS: Import API bypasses publication roles for protected content |
| CVE-2026-113659 | 6.1 MEDIUM | ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-base |
| CVE-2026-112953 | 6.0 MEDIUM | ApostropheCMS: Exposure of Sensitive Information via predictable export filenames |
| CVE-2026-113710 | 5.9 MEDIUM | ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unl |
| CVE-2026-113652 | 5.6 MEDIUM | ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attac |
| CVE-2026-112958 | 5.4 MEDIUM | ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization |
| CVE-2026-113662 | 5.4 MEDIUM | ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import ma |
| CVE-2026-112951 | 5.4 MEDIUM | ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb |
| CVE-2026-113661 | 5.4 MEDIUM | ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships |
| CVE-2026-113656 | 5.3 MEDIUM | ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS |
| CVE-2026-113670 | 5.3 MEDIUM | ApostropheCMS: Page REST API authorization bypass |
| CVE-2026-113668 | 5.3 MEDIUM | ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling |
| CVE-2026-113669 | 5.3 MEDIUM | ApostropheCMS: Cross-domain session token in URL confers session takeover |
| CVE-2026-113667 | 5.3 MEDIUM | ApostropheCMS: CAPTCHA response token not URL-encoded |
Showing top 20 of 33 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: apostrophe
-
CVE-2026-113711
ApostropheCMS: Unauthenticated resource exhaustion via pre-a -
CVE-2026-113710
ApostropheCMS: No Attempt Throttling on Authenticated Passwo -
CVE-2026-113671
ApostropheCMS: Host header controls server-side image fetch -
CVE-2026-113670
ApostropheCMS: Page REST API authorization bypass -
CVE-2026-113669
ApostropheCMS: Cross-domain session token in URL confers ses
Same vendor: apostrophecms
-
CVE-2026-113711
ApostropheCMS: Unauthenticated resource exhaustion via pre-a -
CVE-2026-113710
ApostropheCMS: No Attempt Throttling on Authenticated Passwo -
CVE-2026-113671
ApostropheCMS: Host header controls server-side image fetch -
CVE-2026-113670
ApostropheCMS: Page REST API authorization bypass -
CVE-2026-113669
ApostropheCMS: Cross-domain session token in URL confers ses
Same weakness: CWE-674
-
CVE-2026-112895
Pillow: Unbounded recursion parsing a PDF page tree or trail -
CVE-2026-110673
Cpanel::JSON::XS versions before 4.80 for Perl allow stack e -
CVE-2026-112368
Unbounded Recursion in phongo_bson_visit_document/visit_arra -
CVE-2026-8168
Denial-of-service vulnerability in the SVG parser and render -
CVE-2026-111923
Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enroll
V. Comments for CVE-2026-113650
No comments yet