How many CVEs does apostrophecms sanitize-html have?

apostrophecms sanitize-html has 11 published CVE records since 2018.

How many apostrophecms sanitize-html CVEs are in CISA KEV?

None of apostrophecms sanitize-html's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for apostrophecms sanitize-html vulnerabilities?

Yes — 6 of apostrophecms sanitize-html's CVEs have a known public exploit.

Which versions of apostrophecms sanitize-html are affected?

82 distinct apostrophecms sanitize-html versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in apostrophecms sanitize-html CVEs?

apostrophecms sanitize-html's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

How many critical apostrophecms sanitize-html vulnerabilities are there?

apostrophecms sanitize-html has 1 critical and 1 high-severity CVEs.

What is the average severity of apostrophecms sanitize-html CVEs?

The average CVSS base score across apostrophecms sanitize-html's scored CVEs is 6.2.

apostrophecms sanitize-html Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every apostrophecms sanitize-html version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

1.10.16 CVEs
1.11.06 CVEs
1.11.16 CVEs
1.5.26 CVEs
1.7.06 CVEs
1.7.16 CVEs
1.7.26 CVEs
1.8.06 CVEs
1.9.06 CVEs
1.11.45 CVEs
1.18.25 CVEs
1.18.35 CVEs
1.18.45 CVEs
1.18.55 CVEs
1.19.05 CVEs
1.19.15 CVEs
1.19.25 CVEs
1.19.35 CVEs
1.20.05 CVEs
1.21.05 CVEs
1.21.15 CVEs
1.22.05 CVEs
1.27.45 CVEs
2.0.04 CVEs
2.1.04 CVEs
2.1.14 CVEs
2.1.24 CVEs
2.2.04 CVEs
2.3.04 CVEs
2.3.13 CVEs
2.3.22 CVEs
2.3.32 CVEs
2.4.02 CVEs
2.5.02 CVEs
2.5.12 CVEs
2.5.22 CVEs
2.5.32 CVEs
2.6.02 CVEs
2.6.12 CVEs
2.7.02 CVEs
2.10.01 CVE
2.11.01 CVE
2.7.11 CVE
2.7.21 CVE
2.7.31 CVE
2.8.01 CVE
2.8.11 CVE
2.9.01 CVE

Version ranges

< 1.0.31 CVE
< 1.4.31 CVE
< 2.0.01 CVE
< 2.0.0-beta1 CVE
< 2.12.11 CVE
< 2.17.41 CVE
< 2.3.11 CVE
< 2.3.21 CVE
< 2.7.11 CVE
<= 2.17.11 CVE
<= 391 CVE
<= 401 CVE
>= 2.17.1, < 2.17.21 CVE
>= 2.17.51 CVE

Fixed in

1.0.31 CVE
1.4.31 CVE
2.0.01 CVE
2.0.0-beta1 CVE
2.12.11 CVE
2.17.31 CVE
2.17.41 CVE
2.3.11 CVE
2.3.21 CVE
2.7.11 CVE
4a7d7dd099b41c909f2faac056d34cf0275150791 CVE
5d205a1005ba0df80e21d8c64a15bb3accdb24031 CVE
712cb6895825c8bb6ede71a16b42bade42abcaf31 CVE

Find a version

11 CVEs

Sort

sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes
CVE-2026-53606
Public exploit
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.1% (3th pct)2026-06-12
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
CVE-2026-44990
Public exploit
Patch
CWE-79
Critical · CVSS 9.3
EPSS 0.5% (41th pct)2026-06-12
ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
CVE-2026-40186
Public exploit
Patch
CWE-79
Medium · CVSS 6.1
EPSS 0.2% (15th pct)2026-04-15
Medium vulnerability · 2025-09-08
CVE-2014-125128
Public exploit
Patch
CWE-79
Medium · CVSS 6.1
EPSS 0.3% (17th pct)2025-09-08
Medium vulnerability · 2025-09-08
CVE-2019-25225
Public exploit
Patch
CWE-79
Medium · CVSS 6.1
EPSS 0.3% (17th pct)2025-09-08
Medium vulnerability · 2024-02-24
CVE-2024-21501
Public exploit
Patch
CWE-200
Medium · CVSS 5.3
EPSS 1.0% (60th pct)2024-02-24
High vulnerability · 2022-08-30
CVE-2022-25887
Patch
High · CVSS 7.5
EPSS 1.1% (64th pct)2022-08-30
Medium vulnerability · 2021-02-08
CVE-2021-26540
Patch
Medium · CVSS 5.3
EPSS 1.8% (76th pct)2021-02-08
Medium vulnerability · 2021-02-08
CVE-2021-26539
Patch
Medium · CVSS 5.3
EPSS 2.0% (78th pct)2021-02-08
Medium vulnerability · 2020-01-23
CVE-2016-1000237
Patch
Medium · CVSS 6.1
EPSS 0.8% (54th pct)2020-01-23
Medium vulnerability · 2018-06-04
CVE-2017-16016
Patch
CWE-79
Medium · CVSS 6.1
EPSS 1.4% (69th pct)2018-06-04

apostrophecms sanitize-html Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other apostrophecms products

Frequently asked questions

References

Track apostrophecms sanitize-html vulnerabilities