CVE-2026-84371: ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
When SVG animation is allowed, attributeName="href" makes values a list of URL destinations. sanitize-html accepts a list that starts with a safe fragment even when values is explicitly scheme-checked, allowing a later javascript: destination to execute when the sanitized link is activated.
References
- github.com/advisories/GHSA-g8qq-57p8-ggw5
- github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md
- github.com/apostrophecms/apostrophe/commit/1135516a1a4a8f9638641c460488a43d8af20081
- github.com/apostrophecms/apostrophe/commit/38ff1106c8176b16c2da9872acd9b449adcbb949
- github.com/apostrophecms/apostrophe/pull/5552
- github.com/apostrophecms/apostrophe/security/advisories/GHSA-g8qq-57p8-ggw5
- nvd.nist.gov/vuln/detail/CVE-2026-84371
Code Behaviors & Features
Detect and mitigate CVE-2026-84371 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →