Critical 9.3Published Jun 12, 2026

CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Updated under an hour ago (Oct 27, 2026, 10:30 PM ET)

Does this affect you?

It affects apostrophecms sanitize-html and 9 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for apostrophecms sanitize-html

Exploited in the last 30 days

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

CVSS: 9.3 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Sep 10, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

apostrophecms sanitize-html apostrophecms:sanitize_html (from the name)	before 2.17.4	CNA record
Red Hat multicluster engine for Kubernetes 2.1 redhat:multicluster_engine	from 1784312384 not affected	CISA ADP
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 redhat:acm	from 1783350952 not affected	CISA ADP
Red Hat Red Hat Container Native Virtualization 4.19 redhat:container_native_virtualization	from 1784844382 not affected	CISA ADP
Red Hat Red Hat OpenShift Container Platform 4.20 redhat:openshift	from 1788350963 not affected	CISA ADP
Red Hat Red Hat OpenShift Dev Spaces 3.29 redhat:openshift_devspaces	from 1784737150 not affected	CISA ADP
Red Hat Red Hat Quay 3.10 redhat:quay	from 1783750447 not affected	CISA ADP
Red Hat Red Hat Satellite 6.18 redhat:satellite	from 1785922764 not affected	CISA ADP
Red Hat Red Hat Hardened Images redhat:hummingbird	1	CISA ADP
Red Hat Red Hat OpenShift AI (RHOAI) redhat:openshift_ai	All versions	CISA ADP

References

References

https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643	x-refsource-confirm
https://access.redhat.com/errata/RHSA-2026:36882
https://access.redhat.com/errata/RHSA-2026:36883
https://access.redhat.com/errata/RHSA-2026:40262
https://access.redhat.com/errata/RHSA-2026:41031
https://access.redhat.com/errata/RHSA-2026:41055
https://access.redhat.com/errata/RHSA-2026:41064
https://access.redhat.com/errata/RHSA-2026:41066
https://access.redhat.com/errata/RHSA-2026:42146
https://access.redhat.com/errata/RHSA-2026:42796
1–10 of 25

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.