Medium severity · published Feb 8, 2021
CVE-2021-26540
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to…
5.3
CVSS
1.8%
EPSS
No
On KEV
Description
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Sanitize-html · Apostrophecms
before 2.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26540
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26540
Exploit
https://advisory.checkmarx.net/advisory/CX-2021-4309
Release Notes
https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26
Patch
https://github.com/apostrophecms/sanitize-html/pull/460
More from Sanitize-html
9.3
CVE-2026-44990
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
7.5
CVE-2022-25887
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment…
6.1
CVE-2026-40186
ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
6.1
CVE-2014-125128
'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS)
6.1
CVE-2019-25225
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS)