CVE-2026-44990
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Vulnerability in sanitize-html library (versions prior to 2.17.4) in default configuration allows bypassing sanitization and injecting HTML/JavaScript via the <xmp> element. This can lead to stored XSS in applications rendering sanitized output.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or data exfiltration.
Recommendation
Update the sanitize-html library to version 2.17.4 or later.
Original NVD description (English source)
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.