CVE-2014-125128: Apostrophecms Sanitize-Html

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (`href`) attribute in anchor tags (`<a>`), allowing bypasses that contain different casings, whitespace characters, or hexadecimal encodings.

Affected products

• Apostrophecms Sanitize-Html: before 1.0.3 (fixed in 1.0.3)

Published 2025-09-08. Last modified 2026-06-17.