Description
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
Metrics
CVSS 3.1 9.3/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| apostrophecms | sanitize-html | < 2.17.4 |
| Red Hat | multicluster engine for Kubernetes 2.1 | — |
| Red Hat | multicluster engine for Kubernetes 2.11 | — |
| Red Hat | multicluster engine for Kubernetes 2.17 | — |
| Red Hat | multicluster engine for Kubernetes 2.6 | — |
| Red Hat | multicluster engine for Kubernetes 2.8 | — |
| Red Hat | multicluster engine for Kubernetes 2.9 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.11 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.13 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | — |
| Red Hat | Red Hat Container Native Virtualization 4.19 | — |
| Red Hat | Red Hat Container Native Virtualization 4.20 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — |
| Red Hat | Red Hat OpenShift Dev Spaces 3.29 | — |
| Red Hat | Red Hat Quay 3.10 | — |
| Red Hat | Red Hat Quay 3.12 | — |
| Red Hat | Red Hat Quay 3.15 | — |
| Red Hat | Red Hat Quay 3.16 | — |
| Red Hat | Red Hat Quay 3.9 | — |
| Red Hat | Red Hat Satellite 6.18 | — |
| Red Hat | Red Hat Satellite 6.19 | — |
| Red Hat | Red Hat Satellite 6.19 | — |
| Red Hat | Red Hat Hardened Images | — |
| Red Hat | Red Hat Hardened Images | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — |
| Red Hat | Red Hat Satellite 6 | — |
| Red Hat | Red Hat Satellite 6 | — |
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643
- https://access.redhat.com/errata/RHSA-2026:36882
- https://access.redhat.com/errata/RHSA-2026:36883
- https://access.redhat.com/errata/RHSA-2026:40262
- https://access.redhat.com/errata/RHSA-2026:41031
- https://access.redhat.com/errata/RHSA-2026:41055
- https://access.redhat.com/errata/RHSA-2026:41064
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:42146
- https://access.redhat.com/errata/RHSA-2026:42796
- https://access.redhat.com/errata/RHSA-2026:43052
- https://access.redhat.com/errata/RHSA-2026:46598
- https://access.redhat.com/errata/RHSA-2026:46685
- https://access.redhat.com/errata/RHSA-2026:46885
- https://access.redhat.com/errata/RHSA-2026:46903
- https://access.redhat.com/errata/RHSA-2026:47735
- https://access.redhat.com/errata/RHSA-2026:47737
- https://access.redhat.com/errata/RHSA-2026:48124
- https://access.redhat.com/errata/RHSA-2026:51196
- https://access.redhat.com/errata/RHSA-2026:51197
- https://access.redhat.com/errata/RHSA-2026:51349
- https://access.redhat.com/errata/RHSA-2026:57191
- https://access.redhat.com/errata/RHSA-2026:57194
- https://access.redhat.com/errata/RHSA-2026:59593
- https://access.redhat.com/errata/RHSA-2026:60386
- https://access.redhat.com/errata/RHSA-2026:60441
- https://access.redhat.com/errata/RHSA-2026:63046
- https://access.redhat.com/errata/RHSA-2026:63103
- https://access.redhat.com/security/cve/CVE-2026-44990
- https://bugzilla.redhat.com/show_bug.cgi?id=2488565
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44990.json
Timeline
- Published
- Jun 12, 2026
- Last modified
- Oct 26, 2026
- NVD status
- Deferred