Listen to this Post
How CVE-2026-84371 Works
CVE-2026-84371 is a stored Cross-Site Scripting (XSS) vulnerability affecting the `sanitize-html` npm package, a widely-used HTML sanitizer. The core issue lies in how the library handles SVG animation attributes, specifically when `attributeName=”href”` is used on an `
Per the SVG SMIL (Synchronized Multimedia Integration Language) specification, when `attributeName` is set to `href` or xlink:href, the sibling `values` attribute is interpreted as a URI-list—a semicolon-separated list of URLs. The vulnerable code in `index.js` (lines 371-383) validates each attribute as a single, flat URL. It fails to recognize that the `values` attribute, in this specific context, contains a list of URLs with special semantics.
An attacker can exploit this by crafting a `values` list that starts with a safe fragment (like safe) and then includes a malicious `javascript:` URI (e.g., safe;javascript:alert('XSS')). Because the library’s validation only checks if the attribute as a whole appears to be a single valid URL, the leading safe fragment allows the entire string to pass the scheme check. The sanitizer then retains the complete, malicious URI-list in the output.
When a victim clicks the sanitized SVG link, the browser processes the URI-list. It interprets the `javascript:` URI as a valid destination, executing the attacker’s script in the context of the application’s origin. This bypasses the intended scheme policy (allowedSchemesAppliedToAttributes) that is configured to block dangerous schemes like javascript:.
The vulnerability affects `sanitize-html` versions from 1.9.0 up to, but not including, 2.17.7. It was fixed in version 2.17.7.
DailyCVE Form:
Platform: Node.js / ApostropheCMS
Version: 1.9.0 – 2.17.6
Vulnerability: Stored XSS (CWE-79)
Severity: Medium (CVSS 5.4)
Date: 2026-09-01
Prediction: Patch expected by 2026-09-02
What Undercode Say:
Analytics
The vulnerability is triggered when an attacker submits crafted SVG content to an application that uses a vulnerable version of `sanitize-html` and allows specific SVG animation elements like animate, animateColor, animateMotion, animateTransform, or set. The `values` attribute is used to store the payload.
Bash commands to reproduce the vulnerability:
Install the vulnerable version npm install [email protected] Create the PoC file (poc.js) and run it to generate the HTML node poc.js > poc.html Open the generated poc.html file in a browser and click the "Click me" text
PoC JavaScript code (poc.js):
const sanitize = require('sanitize-html');
const input = <code><svg><a><animate attributeName="href" values="safe;javascript:alert('XSS')" dur=".01s" fill="freeze"></animate><text y="30">Click me</text></a></svg></code>;
const output = sanitize(input, {
allowedTags: sanitize.defaults.allowedTags.concat(['svg', 'animate', 'text']),
allowedAttributes: {
...sanitize.defaults.allowedAttributes,
animate: ['attributename', 'values', 'dur', 'fill'],
text: ['y']
},
allowedSchemesAppliedToAttributes:
sanitize.defaults.allowedSchemesAppliedToAttributes.concat(['values'])
});
console.log(output);
Exploit: (Educational Purposes!)
- Craft the Payload: The attacker creates an SVG payload where an `
` element uses `attributeName=”href”` and a `values` attribute containing a malicious URI-list, e.g., values="safe;javascript:alert('XSS')". - Submit the Payload: The attacker submits this SVG payload to a vulnerable application that uses `sanitize-html` in a configuration allowing the required SVG tags and attributes.
- Bypass Sanitization: The `sanitize-html` library processes the input. Due to the flaw, it validates the `values` attribute as a single URL and, seeing the safe `safe` fragment, allows the entire list to pass, including the `javascript:` URI.
- Store and Deliver: The application stores the unsanitized payload and later renders it to other users.
- Victim Interaction: A victim views the page and clicks the sanitized SVG link.
- Script Execution: The victim’s browser processes the URI-list from the `values` attribute, follows the `javascript:` URI, and executes the attacker’s script within the application’s security context.
Protection:
Immediate Fix: Upgrade the `sanitize-html` package to version 2.17.7 or later. If using ApostropheCMS, update to a version that includes this fix.
Workaround: If an immediate upgrade is not possible, modify the `sanitize-html` configuration to disallow the vulnerable SVG animation elements: animate, animateColor, animateMotion, animateTransform, and set.
Content Security Policy (CSP): Implement a strict CSP to mitigate the impact of XSS, even if a bypass is successful.
Input Validation: As a defense-in-depth measure, consider rejecting any `values` attribute that contains a semicolon (;) when it appears on an element with `attributeName=”href”` or attributeName="xlink:href".
Impact:
Stored Cross-Site Scripting (XSS): An attacker can inject and store malicious JavaScript code within the application.
Account Takeover: The injected script can steal session cookies, allowing the attacker to impersonate the victim.
Data Theft: The attacker can exfiltrate sensitive data, including CSRF tokens and other confidential information accessible to the victim’s session.
Application Defacement: The attacker could modify the content of the page as seen by the victim.
Privilege Escalation: If the victim has administrative privileges, the attacker could gain control of the entire application.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
