StackRadar

CVE-2026-113654

Medium

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
70
of 18,208 indexed, latest versions
Container images
64
deployed by those charts
Fix available
1 of 1
affected package

ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

Carried by container images the latest versions of 70 of 18,208 indexed charts deploy, on 64 images.

Affected packageAffected versionsFixed inImages
sanitize-htmlnpm1.4.2, 1.14.1, 1.18.5, 1.19.1+13 more2.18.064
OSV records
GHSA-x3q4-9hxx-gx8m

Charts affected

70 by stars
ChartLatestAffected imagesRadar Score
security-role-perm-operator-svcmojaloop3.0.01 of 1See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
sanitize-html@2.12.1
2.18.0

Open the chart page →

2,897
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
sanitize-html@2.17.0
2.18.0

Open the chart page →

6,484
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
sanitize-html@2.17.5
2.18.0

Open the chart page →

2,510
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
sanitize-html@2.3.3
2.18.0

Open the chart page →

10,598
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
sanitize-html@2.17.5
2.18.0

Open the chart page →

2,510
xyopsquench-xyops0.0.261 of 1See more

xyops quench-xyops 0.0.26

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/xyopsdigest-pinnedec6c76854898
sanitize-html@2.17.7
2.18.0

Open the chart page →

47
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
sanitize-html@2.17.0
2.18.0

Open the chart page →

5,339
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
sanitize-html@2.12.1
2.18.0

Open the chart page →

17,778
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
sanitize-html@2.12.1
2.18.0

Open the chart page →

17,864
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f81 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
sanitize-html@2.8.1
2.18.0

Open the chart page →

15,979
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
sanitize-html@2.12.1
2.18.0

Open the chart page →

17,864
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4691 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
sanitize-html@2.12.1
2.18.0

Open the chart page →

15,582
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
sanitize-html@2.12.1
2.18.0

Open the chart page →

15,582
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
sanitize-html@2.12.1
2.18.0

Open the chart page →

17,432
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
sanitize-html@2.12.1
2.18.0

Open the chart page →

17,095
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
sanitize-html@2.12.1
2.18.0

Open the chart page →

12,189
strapistrapi-xmv0.1.21 of 1See more

strapi strapi-xmv 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
sanitize-html@2.13.0
2.18.0

Open the chart page →

701
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
sanitize-html@2.7.0
2.18.0

Open the chart page →

4,401
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
sanitize-html@2.12.1
2.18.0

Open the chart page →

8,015
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
twentycrm/twenty:latest7ea7839b8945
sanitize-html@2.17.7
2.18.0

Open the chart page →

72,914

Container images carrying it

64 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
sanitize-html@2.12.1
2.18.0
1
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
sanitize-html@2.12.1
2.18.0
1
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
sanitize-html@2.12.1
2.18.0
1
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
sanitize-html@2.12.1
2.18.0
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
sanitize-html@2.7.0
2.18.0
1
twentycrm/twenty:latest7ea7839b8945
sanitize-html@2.17.7
2.18.0
1
twentycrm/twenty:v2.49.080e1b33b0b4b
sanitize-html@2.17.7
2.18.0
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
sanitize-html@2.17.7
2.18.0
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
sanitize-html@2.11.0
2.18.0
1
ghcr.io/data-fair/portals:18b621866ceb2
sanitize-html@1.27.5
2.18.0
1
ghcr.io/quenchworks/images/xyopsec6c76854898
sanitize-html@2.17.7
2.18.0
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main305999dea18a
sanitize-html@2.17.7
2.18.0
1
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
sanitize-html@2.13.0
2.18.0
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
sanitize-html@2.3.3
2.18.0
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.