CVE-2026-113657

Name of the Vulnerable Software and Affected Versions sanitize-html versions 2.17.7 through 2.17.9

Description An issue exists where application configurations permitting namespace-prefixed SVG animation elements and relevant URL-targeting attributes can bypass SMIL URL protection. This occurs because the animatesUrlAttribute() function checks tag names against a list of bare local names, but does not strip namespace prefixes (e.g., svg:animate instead of animate). Consequently, an attacker can inject a prefixed animation element to rewrite a link destination to an unsafe URI after the sanitized SVG is rendered, leading to cross-site scripting (XSS) when a user activates the affected link. This bypass affects the following animation elements: animate, animateColor, animateMotion, animateTransform, and set.

Recommendations Update sanitize-html to version 2.18.0.