StackRadar

CVE-2026-113654

Medium

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
70
of 18,208 indexed, latest versions
Container images
64
deployed by those charts
Fix available
1 of 1
affected package

ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

Carried by container images the latest versions of 70 of 18,208 indexed charts deploy, on 64 images.

Affected packageAffected versionsFixed inImages
sanitize-htmlnpm1.4.2, 1.14.1, 1.18.5, 1.19.1+13 more2.18.064
OSV records
GHSA-x3q4-9hxx-gx8m

Charts affected

70 by stars
ChartLatestAffected imagesRadar Score
security-role-perm-operator-svcmojaloop3.0.01 of 1See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
sanitize-html@2.12.1
2.18.0

Open the chart page →

2,897
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
sanitize-html@2.17.0
2.18.0

Open the chart page →

6,484
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
sanitize-html@2.17.5
2.18.0

Open the chart page →

2,510
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
sanitize-html@2.3.3
2.18.0

Open the chart page →

10,598
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
sanitize-html@2.17.5
2.18.0

Open the chart page →

2,510
xyopsquench-xyops0.0.261 of 1See more

xyops quench-xyops 0.0.26

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/xyopsdigest-pinnedec6c76854898
sanitize-html@2.17.7
2.18.0

Open the chart page →

47
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
sanitize-html@2.17.0
2.18.0

Open the chart page →

5,339
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
sanitize-html@2.12.1
2.18.0

Open the chart page →

17,778
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
sanitize-html@2.12.1
2.18.0

Open the chart page →

17,864
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f81 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
sanitize-html@2.8.1
2.18.0

Open the chart page →

15,979
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
sanitize-html@2.12.1
2.18.0

Open the chart page →

17,864
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4691 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
sanitize-html@2.12.1
2.18.0

Open the chart page →

15,582
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
sanitize-html@2.12.1
2.18.0

Open the chart page →

15,582
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
sanitize-html@2.12.1
2.18.0

Open the chart page →

17,432
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
sanitize-html@2.12.1
2.18.0

Open the chart page →

17,095
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
sanitize-html@2.12.1
2.18.0

Open the chart page →

12,189
strapistrapi-xmv0.1.21 of 1See more

strapi strapi-xmv 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
sanitize-html@2.13.0
2.18.0

Open the chart page →

701
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
sanitize-html@2.7.0
2.18.0

Open the chart page →

4,401
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
sanitize-html@2.12.1
2.18.0

Open the chart page →

8,015
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-113654.

Container imageDigestPackageFixed in
twentycrm/twenty:latest7ea7839b8945
sanitize-html@2.17.7
2.18.0

Open the chart page →

72,914

Container images carrying it

64 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
sanitize-html@1.27.5
2.18.0
3
rcdelacruz/my-strapi-app:js-amd6438007f358355
sanitize-html@2.11.0
2.18.0
3
governify/assets-manager:v1.4.12987672448c7
sanitize-html@1.27.5
2.18.0
2
library/ghost:6.71.000032f157262
sanitize-html@2.17.7
2.18.0
2
mojaloop/central-ledger:v13.14.01abc8a7aa71c
sanitize-html@1.27.5
2.18.0
2
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
sanitize-html@1.27.5
2.18.0
2
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
sanitize-html@1.27.5
2.18.0
2
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
sanitize-html@1.27.5
2.18.0
2
mojaloop/role-assignment-service:v2.1.0def4bf273721
sanitize-html@1.27.5
2.18.0
2
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
sanitize-html@2.12.1
2.18.0
2
n8nio/n8n:2.36.714c4285bc303
sanitize-html@2.17.5
2.18.0
2
amundsendev/amundsen-frontend:2.1.169e7915e61c1
sanitize-html@1.19.1
2.18.0
1
bkimminich/juice-shop:v20.2.08739101ade29
sanitize-html@1.4.2
2.18.0
1
chocobozzz/peertube:v8.1.5052712130691
sanitize-html@2.17.1
2.18.0
1
daskdev/dask-notebook:1.1.0052630f5ca04
sanitize-html@1.18.5
2.18.0
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
sanitize-html@2.13.0
2.18.0
1
directus/directus:12.0.29c8470ea465c
sanitize-html@2.17.0
2.18.0
1
directus/directus:11.1.0e3c8bb975350
sanitize-html@2.13.0
2.18.0
1
diygod/rsshub:2025-11-097a6312cac0d5
sanitize-html@2.17.0
2.18.0
1
epam/ai-dial-chat:1.2.4df205138325d
sanitize-html@2.17.7
2.18.0
1
library/ghost:6.37.01ef2e532ca4d
sanitize-html@2.17.0
2.18.0
1
library/ghost:6.25.12654b1e90413
sanitize-html@2.17.0
2.18.0
1
library/ghost:6.41.129773d6be407
sanitize-html@2.17.4
2.18.0
1
library/ghost:6.69.055131b90d48c
sanitize-html@2.17.7
2.18.0
1
library/ghost:4.37.0767230c0f263
sanitize-html@2.7.0
2.18.0
1
library/ghost:6.39.0-alpine77196da4b0df
sanitize-html@2.17.0
2.18.0
1
library/ghost:5.79.083f7bf209844
sanitize-html@2.11.0
2.18.0
1
library/ghost:6.69.0-alpine3.23db4c56c196d6
sanitize-html@2.17.7
2.18.0
1
makeplane/live-commercial:v3.3.3fab034a2be8c
sanitize-html@2.17.7
2.18.0
1
makeplane/silo-commercial:v3.3.312c33418c1ec
sanitize-html@2.17.7
2.18.0
1
makeplane/space-commercial:v3.3.3c4a6236c4080
sanitize-html@2.17.7
2.18.0
1
microcks/microcks-postman-runtime:latestcb72e46a1b3c
sanitize-html@1.14.1
2.18.0
1
misskey/misskey:12.110.1e08b7c478093
sanitize-html@2.7.0
2.18.0
1
n8nio/n8n:2.25.7761374d4eb84
sanitize-html@2.12.1
2.18.0
1
n8nio/n8n:2.41.687e0bab2c931
sanitize-html@2.17.7
2.18.0
1
n8nio/n8n:1.86.08b39ed5a2de9
sanitize-html@2.12.1
2.18.0
1
n8nio/n8n:0.212.0a9195bc499a3
sanitize-html@2.7.0
2.18.0
1
n8nio/n8n:2.44.4c72fa9f1bd9b
sanitize-html@2.17.7
2.18.0
1
n8nio/n8n:2.36.8cfe2704ff858
sanitize-html@2.17.5
2.18.0
1
n8nio/n8n:2.43.3d4eca183959b
sanitize-html@2.17.7
2.18.0
1
n8nio/n8n:1.115.1ed16e560c40e
sanitize-html@2.12.1
2.18.0
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
sanitize-html@2.17.6
2.18.0
1
nousresearch/hermes-agent:v2026.9.24fca358f12efd
sanitize-html@2.17.7
2.18.0
1
polonel/trudesk:1.2.60cf6513f6fe3
sanitize-html@2.7.0
2.18.0
1
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
sanitize-html@2.8.1
2.18.0
1
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
sanitize-html@2.12.1
2.18.0
1
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
sanitize-html@2.12.1
2.18.0
1
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
sanitize-html@2.12.1
2.18.0
1
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
sanitize-html@2.12.1
2.18.0
1
speckle/speckle-server:2.26.379f14a2bf931
sanitize-html@2.12.1
2.18.0
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.