CVE-2026-44990criticalCWE-79

CVE-2026-44990: fallo crítico en apostrophecms sanitize-html

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear sanitize-html+ Monitorear sanitize-html

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 0.7%
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Productos afectados
apostrophecms · sanitize-html
CVEs relacionadas — apostrophecms sanitize-html

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-113650MEDIUMApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)EPSS 0.5%CVE-2026-113654MEDIUMApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderEPSS 0.4%CVE-2026-113657LOWApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)EPSS 0.3%CVE-2026-113661MEDIUMApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsEPSS 0.3%CVE-2026-40186MEDIUMApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags ElementsEPSS 0.2%CVE-2026-53606MEDIUMsanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributesEPSS 0.2%