Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Summary

CVE	CVE-2026-44990
State	PUBLISHED
Assigner	GitHub_M
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-06-12 21:16:22 UTC
Updated	2026-06-30 03:20:02 UTC
Description	ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Risk And Classification

Primary CVSS: v3.1 8.1 HIGH from ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS: 0.003700000 probability, percentile 0.289500000 (date 2026-07-04)

Problem Types: CWE-79 | CWE-79 CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Version	Source	Type	Score	Severity	Vector
3.1	ADP	CVSS	8.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N`
3.1	[email protected]	Secondary	9.3	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`
3.1	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	Secondary	8.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N`
3.1	CNA	DECLARED	9.3	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Apostrophecms	Sanitize-html	affected < 2.17.4	Not specified
ADP	Red Hat	Multicluster Engine For Kubernetes	Not specified	Not specified
ADP	Red Hat	Red Hat Advanced Cluster Management For Kubernetes 2	Not specified	Not specified
ADP	Red Hat	Red Hat Hardened Images	Not specified	Not specified
ADP	Red Hat	Red Hat OpenShift AI RHOAI	Not specified	Not specified
ADP	Red Hat	Red Hat OpenShift Container Platform 4	Not specified	Not specified
ADP	Red Hat	Red Hat OpenShift Dev Spaces	Not specified	Not specified
ADP	Red Hat	Red Hat OpenShift Virtualization 4	Not specified	Not specified
ADP	Red Hat	Red Hat Quay 3	Not specified	Not specified
ADP	Red Hat	Red Hat Satellite 6	Not specified	Not specified

References

Reference	Source	Link	Tags
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44990.json	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	security.access.redhat.com
github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643	134c704f-9b21-4f2e-91b3-4a467353bcc0	github.com
access.redhat.com/security/cve/CVE-2026-44990	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com
bugzilla.redhat.com/show_bug.cgi	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	bugzilla.redhat.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Additional Advisory Data

Source	Time	Event
ADP	2026-06-12T21:02:24.911Z	Reported to Red Hat.
ADP	2026-06-12T20:39:47.065Z	Made public.

Workarounds

ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

There are currently no legacy QID mappings associated with this CVE.