CVE-2026-44990
published 2026-06-12CVE-2026-44990: ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default…
PriorityP352critical9.3CVSS 3.1
AVNACLPRNUIRSCCHIHAN
EPSS
0.69%
51.3th percentile
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apostrophecms | sanitize-html | < 2.17.4 | 2.17.4 |
| apostrophecms | sanitize-html | >= 0 < 2.17.6 | 2.17.6 |
| apostrophecms | sanitize-html | 0 – 2.17.3 | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| multicluster-engine | console-mce-rhel9 | — | — |
| open-telemetry | opentelemetry-collector-contrib | — | — |
| openshift4 | ose-agent-installer-ui-rhel9 | — | — |
| openshift4 | ose-console | — | — |
| openshift4 | ose-console-rhel9 | — | — |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhacm2 | console-rhel9 | — | — |
| rhoai | odh-mlflow-rhel9 | — | — |
| satellite | iop-advisor-frontend-rhel9 | — | — |
| satellite | iop-host-inventory-frontend-rhel9 | — | — |
| satellite | iop-vulnerability-frontend-rhel9 | — | — |
CVSS provenance
nvdv3.19.3CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
ghsa6.1MEDIUM
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
ghsa·2026-09-03·CVSS 6.1
CVE-2026-63670 [MEDIUM] CWE-79 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `` solidus close
### Summary
A mutation-XSS / allowedTags bypass: when `textarea` (or `xmp`) is included in `allowedTags`, an input containing a literal `` (a solidus right after the RCDATA end-tag name) lets non-allowed markup such as `` pass through `sanitizeHtml()` **live and unescaped**, even though `img`/`onerror` are not in the allowlist. A spec-compliant browser executes the surviving handler — XSS. This is a literal-solidus variant that bypasses the two most recent fixes in this code area (CVE-2026-40186, CVE-2026-44990), both already applied in 2.17.5. The default configuration is not affected.
### Details
`sanitize-html` emits the text content of HTML raw-text elements (`textarea`, `xmp`) without escaping. Two things
VulDB
apostrophecms apostrophe up to 2.17.3 API cross site scripting (GHSA-rpr9-rxv7-x643)
vuldb·2026-06-13·CVSS 9.3
CVE-2026-44990 [CRITICAL] apostrophecms apostrophe up to 2.17.3 API cross site scripting (GHSA-rpr9-rxv7-x643)
A vulnerability was found in apostrophecms apostrophe up to 2.17.3 and classified as problematic. This impacts an unknown function of the component API. Such manipulation leads to cross site scripting.
This vulnerability is listed as CVE-2026-44990. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
ghsa·2026-05-14
CVE-2026-44990 [CRITICAL] CWE-79 Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
### Summary
Under the default configuration, `sanitize-html` can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users.
### Details
In `[email protected]`, the default `nonTextTags` list includes only `script`, `style`, `textarea`, and `option` in `index.js` lines 138-142. That means disallowed `xmp` tags are not treated as "drop the entire contents" tags.
Later, in the `ontext` handler at `index.js` lines 569-577, the code special-cases `textarea` and `xmp` and appends their text content directly to the
Red Hat
sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass
vendor_redhat·2026-06-12·CVSS 9.3
CVE-2026-44990 [CRITICAL] CWE-79 sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass
sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-44990 prometheus: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 prometheus: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
CVE-2026-44990 prometheus: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 python-jupyterlab-widgets: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 python-jupyterlab-widgets: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
CVE-2026-44990 python-jupyterlab-widgets: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 jupyterlab: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 jupyterlab: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
CVE-2026-44990 jupyterlab: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 python-ipyparallel: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 python-ipyparallel: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
CVE-2026-44990 python-ipyparallel: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 prometheus: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 prometheus: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
CVE-2026-44990 prometheus: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 python-nbdime: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 python-nbdime: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
CVE-2026-44990 python-nbdime: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 python-jupyterlab-widgets: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 python-jupyterlab-widgets: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
CVE-2026-44990 python-jupyterlab-widgets: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 golang-github-apache-beam-2: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 golang-github-apache-beam-2: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
CVE-2026-44990 golang-github-apache-beam-2: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 cockatrice: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 cockatrice: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
CVE-2026-44990 cockatrice: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 glances: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 glances: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
CVE-2026-44990 glances: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 python-jupyterlab_pygments: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 python-jupyterlab_pygments: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
CVE-2026-44990 python-jupyterlab_pygments: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 python-jupyterlab_pygments: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 python-jupyterlab_pygments: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
CVE-2026-44990 python-jupyterlab_pygments: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 glances: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 glances: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
CVE-2026-44990 glances: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 python-ipyparallel: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 python-ipyparallel: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
CVE-2026-44990 python-ipyparallel: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 jupyterlab: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 jupyterlab: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
CVE-2026-44990 jupyterlab: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 python-jupytext: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
bugzilla·2026-06-25·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 python-jupytext: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
CVE-2026-44990 python-jupytext: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-44990 sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass
bugzilla·2026-06-12·CVSS 9.3
CVE-2026-44990 [CRITICAL] CVE-2026-44990 sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass
CVE-2026-44990 sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643https://access.redhat.com/errata/RHSA-2026:36882https://access.redhat.com/errata/RHSA-2026:36883https://access.redhat.com/errata/RHSA-2026:40262https://access.redhat.com/errata/RHSA-2026:41031https://access.redhat.com/errata/RHSA-2026:41055https://access.redhat.com/errata/RHSA-2026:41064https://access.redhat.com/errata/RHSA-2026:41066https://access.redhat.com/errata/RHSA-2026:42146https://access.redhat.com/errata/RHSA-2026:42796https://access.redhat.com/errata/RHSA-2026:43052https://access.redhat.com/errata/RHSA-2026:46598https://access.redhat.com/errata/RHSA-2026:46685https://access.redhat.com/errata/RHSA-2026:46885https://access.redhat.com/errata/RHSA-2026:46903https://access.redhat.com/errata/RHSA-2026:47735https://access.redhat.com/errata/RHSA-2026:47737https://access.redhat.com/errata/RHSA-2026:48124https://access.redhat.com/errata/RHSA-2026:51196https://access.redhat.com/errata/RHSA-2026:51197https://access.redhat.com/errata/RHSA-2026:51349https://access.redhat.com/errata/RHSA-2026:57191https://access.redhat.com/errata/RHSA-2026:57194https://access.redhat.com/errata/RHSA-2026:59593https://access.redhat.com/errata/RHSA-2026:60386https://access.redhat.com/errata/RHSA-2026:60441https://access.redhat.com/errata/RHSA-2026:63046https://access.redhat.com/errata/RHSA-2026:63103https://access.redhat.com/security/cve/CVE-2026-44990https://bugzilla.redhat.com/show_bug.cgi?id=2488565https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44990.json
2026-06-12
Published