CVE-2021-26539: Apostrophecms Sanitize-Html

Medium severity, CVSS 5.3. EPSS: 2% chance of exploitation in the next 30 days.

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.

Affected products

• Apostrophecms Sanitize-Html: before 2.3.1 (fixed in 2.3.1)

Published 2021-02-08. Last modified 2026-06-17.