中文

// CVE · PUBLISHED 2026-06-12

CVE-2026-44990

apostrophecms / sanitize-html · Red Hat / multicluster engine for Kubernetes 2.1 · Red Hat / multicluster engine for Kubernetes 2.11 · +27

9.3 · CVSS 3.1Critical

Description

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

References

Related CVEs

← CVE Index: search every CVE from the last 30 days

This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.