CVE-2026-44990
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Vulnerability in sanitize-html library (versions prior to 2.17.4) in default configuration allows bypassing sanitization and injecting HTML/JavaScript via the <xmp> element. This can lead to stored XSS in applications rendering sanitized output.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or data exfiltration.
Recommendation
Update the sanitize-html library to version 2.17.4 or later.
Other vulnerabilities in sanitize-html
See all- CVE-2026-84371Medium
In ApostropheCMS (Node.js CMS) and the sanitize-html library (from version 1.9.0 to 2.17.7), there is a vulnerability in the sanitize-html package where the validation of the animation value attribute does not recognize that attributeName selecting href or xlink:href gives the sibling values from, to, or by SVG SMIL URL semantics. In configurations that allow animate, animateColor, animateMotion, animateTransform, or set elements, a values list can begin with a safe fragment and contain a later executable destination that survives allowedSchemesAppliedToAttributes checking. When the sanitized SVG is rendered, the browser can copy that later destination into the live link, and a victim who activates the link can execute script in the application's origin. This issue is fixed in version 2.17.7.
- CVE-2026-53606Medium
ApostropheCMS, an open-source Node.js content management system, has a vulnerability in sanitize-html that allows dangerous URI schemes like 'javascript:' to pass through in HTML attributes. Versions prior to 2.17.5 do not block these schemes, leading to potential XSS attacks.
Original NVD description (English source)
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS