What’s Vulnerable › Vulnerabilities

CVE-2026-44990: Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

• Severity: critical (CVSS 9.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-12 · updated 2026-10-26
• Weakness: CWE-79

Description

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Affected products

• apostrophecms sanitize-html: before 2.17.4

References

• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643
• https://access.redhat.com/errata/RHSA-2026:36882
• https://access.redhat.com/errata/RHSA-2026:36883
• https://access.redhat.com/errata/RHSA-2026:40262
• https://access.redhat.com/errata/RHSA-2026:41031
• https://access.redhat.com/errata/RHSA-2026:41055
• https://access.redhat.com/errata/RHSA-2026:41064
• https://access.redhat.com/errata/RHSA-2026:41066
• https://access.redhat.com/errata/RHSA-2026:42146
• https://access.redhat.com/errata/RHSA-2026:42796
• https://access.redhat.com/errata/RHSA-2026:43052
• https://access.redhat.com/errata/RHSA-2026:46598

Get alerted when CVE-2026-44990 or the next vulnerability affects your stack