{"vulnerability": "ghsa-g8qq-57p8-ggw5", "sightings": [{"uuid": "f89dabaf-741a-4871-8cc4-512a07f7dcf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-g8qq-57p8-ggw5", "type": "seen", "source": "https://gist.github.com/alon710/b64f54e586f64f04282972c26771d917", "content": "# CVE-2026-84371: CVE-2026-84371: Stored XSS via SVG SMIL URI-list Scheme-Policy Bypass in sanitize-html\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84371\n\n## Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in sanitize-html from version 1.9.0 up to 2.17.6. The flaw permits attackers to bypass scheme-policy enforcement using SVG SMIL animation elements targeting URL attributes with semicolon-separated URI lists.\n\n## TL;DR\nSVG SMIL animation tags allow bypass of sanitize-html's scheme filtering via semicolon-separated lists in 'values' attributes, leading to arbitrary JavaScript execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity Score**: 5.4 (Medium)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n- **Impact**: Stored Cross-Site Scripting (XSS)\n\n## Affected Systems\n\n- sanitize-html\n- **sanitize-html**: >= 1.9.0, < 2.17.7 (Fixed in: `2.17.7`)\n\n## Mitigation\n\n- Upgrade sanitize-html to version 2.17.7 or higher\n- Remove SVG animation tags (animate, set) from allowedTags in sanitize-html configurations\n- Deploy Content Security Policy (CSP) headers that disable unsafe-inline javascript execution\n\n**Remediation Steps:**\n1. Identify all service dependencies and update package.json to require sanitize-html >= 2.17.7\n2. Execute `npm update sanitize-html` or `yarn upgrade sanitize-html`\n3. Verify sanitize-html instantiation calls across the codebase to ensure SVG SMIL animation tags are not explicitly enabled\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-g8qq-57p8-ggw5)\n- [Upstream Fix Commit (Branch Integration)](https://github.com/apostrophecms/apostrophe/commit/1135516a1a4a8f9638641c460488a43d8af20081)\n- [Upstream Fix Commit (Reconciliation & Release)](https://github.com/apostrophecms/apostrophe/commit/38ff1106c8176b16c2da9872acd9b449adcbb949)\n- [Official Pull Request](https://github.com/apostrophecms/apostrophe/pull/5552)\n- [Changelog Documentation](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84371) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T07:31:58.768775Z"}]}