CVE-2026-44990
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jun 12, 2026
- Updated
- Sep 10, 2026
- Reserved
- May 8, 2026
Description
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.3 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N | GitHub_M |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | redhat-SADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
sanitize-htmlapostrophecms |
|
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643
- https://access.redhat.com/security/cve/CVE-2026-44990vdb-entry
- RHBZ#2488565issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44990.json
- https://access.redhat.com/errata/RHSA-2026:41064vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:47737vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:36882vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:46903vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:57191vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:60386vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:46685vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:46598vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:63103vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:63046vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:60441vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:48124vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:41031vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:42146vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:43052vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:42796vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:41066vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:40262vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:51349vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:51196vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:51197vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:57194vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:59593vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:46885vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:41055vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:47735vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:36883vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.