CVE-2021-26540

PoC —

CVSS 3.1

5.3 medium

EPSS

2%p77

Published

Feb 8, 2021 (Feb 8, 2021)

Modified

Jun 17, 2026

Description

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".

Vendors: apostrophecms
Products: sanitize-html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.8%)

In the news0 stories

No ingested article mentions this CVE yet.