{"vulnerability": "CVE-2026-84371", "sightings": [{"uuid": "87cd939e-8310-438f-a899-984998597dc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84371", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/brv6imqhpe426", "content": "CVE-2026-84371 - ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass\nCVE ID : CVE-2026-84371\n \n Published : Sept. 1, 2026, 8:51 p.m. | 23\u00a0minutes ago\n \n Description : ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides...", "creation_timestamp": "2026-09-01T21:35:23.810652Z"}, {"uuid": "dd12274c-4d24-4b75-8c0f-5fc8898a8c42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-84371", "type": "published-proof-of-concept", "source": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-g8qq-57p8-ggw5", "content": "", "creation_timestamp": "2026-09-01T22:35:05.027508Z"}, {"uuid": "41e2841c-4ec9-43a4-a4f7-22edf48cc961", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84371", "type": "seen", "source": "https://gist.github.com/alon710/b64f54e586f64f04282972c26771d917", "content": "# CVE-2026-84371: CVE-2026-84371: Stored XSS via SVG SMIL URI-list Scheme-Policy Bypass in sanitize-html\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84371\n\n## Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in sanitize-html from version 1.9.0 up to 2.17.6. The flaw permits attackers to bypass scheme-policy enforcement using SVG SMIL animation elements targeting URL attributes with semicolon-separated URI lists.\n\n## TL;DR\nSVG SMIL animation tags allow bypass of sanitize-html's scheme filtering via semicolon-separated lists in 'values' attributes, leading to arbitrary JavaScript execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity Score**: 5.4 (Medium)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n- **Impact**: Stored Cross-Site Scripting (XSS)\n\n## Affected Systems\n\n- sanitize-html\n- **sanitize-html**: >= 1.9.0, < 2.17.7 (Fixed in: `2.17.7`)\n\n## Mitigation\n\n- Upgrade sanitize-html to version 2.17.7 or higher\n- Remove SVG animation tags (animate, set) from allowedTags in sanitize-html configurations\n- Deploy Content Security Policy (CSP) headers that disable unsafe-inline javascript execution\n\n**Remediation Steps:**\n1. Identify all service dependencies and update package.json to require sanitize-html >= 2.17.7\n2. Execute `npm update sanitize-html` or `yarn upgrade sanitize-html`\n3. Verify sanitize-html instantiation calls across the codebase to ensure SVG SMIL animation tags are not explicitly enabled\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-g8qq-57p8-ggw5)\n- [Upstream Fix Commit (Branch Integration)](https://github.com/apostrophecms/apostrophe/commit/1135516a1a4a8f9638641c460488a43d8af20081)\n- [Upstream Fix Commit (Reconciliation & Release)](https://github.com/apostrophecms/apostrophe/commit/38ff1106c8176b16c2da9872acd9b449adcbb949)\n- [Official Pull Request](https://github.com/apostrophecms/apostrophe/pull/5552)\n- [Changelog Documentation](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84371) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T07:31:58.700819Z"}]}