CVE-2026-63670: falha de média gravidade em apostrophecms apostrophe
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.3%
ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
apostrophecms · apostropheCVEs relacionadas — apostrophecms apostrophe
No mesmo produto, das mais perigosas para as menos.
CVE-2026-113658HIGHApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryEPSS 0.6%CVE-2026-113711HIGHApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportEPSS 0.6%CVE-2026-112953MEDIUMApostropheCMS: Exposure of Sensitive Information via predictable export filenamesEPSS 0.6%CVE-2026-112955MEDIUMApostropheCMS: Import archives can exhaust server storage and deny serviceEPSS 0.5%CVE-2026-33888MEDIUMApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST APIEPSS 0.5%CVE-2026-113664MEDIUMApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testEPSS 0.5%