CVE-2026-113654

Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.18.0

Description A flaw exists when a non-default nonTextTags configuration includes noscript. The sanitizer fails to correctly handle implied ancestor close events emitted by htmlparser2 inside a noscript element, causing the discard region to end prematurely. Consequently, content that should remain inert is treated as ordinary body content and rendered. This occurs because scripting-enabled browsers treat noscript content as raw text, while the parser does not model this mode, leading to a discrepancy where the sanitizer emits elements that the browser would not have rendered.

Recommendations Update sanitize-html to version 2.18.0.