Every CVE Search/ Get API key

CVE-2026-44990

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

9.3 CriticalFix available

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of sanitize-html prior to 2.17.4 can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.68%Up 0.6 points since Jun 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.3

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of sanitize-html prior to 2.17.4 can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Record
CVE-2026-44990
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-79, CWE-79
Updated
2026-11-02
EUVDEUVD-2026-36566 9.3

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of sanitize-html prior to 2.17.4 can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Record
EUVD-2026-36566
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-rpr9-rxv7-x643 9.3

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Summary

Under the default configuration, sanitize-html can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized output back to users.

Details

In [email protected], the default nonTextTags list includes only script, style, textarea, and option in index.js lines 138-142. That means disallowed xmp tags are not treated as "drop the entire contents" tags.

Later, in the ontext handler at index.js lines 569-577, the code special-cases textarea and xmp and appends their text content directly to the output without escaping:

} else if ((options.disallowedTagsMode === 'discard' || options.disallowedTagsMode === 'completelyDiscard') && (tag === 'textarea' || tag === 'xmp')) {
  result += text;
}

Because htmlparser2 treats xmp as a raw-text element, markup inside xmp is parsed as text on input but becomes live markup again once it is appended unescaped to the sanitized output.

This creates a default sanitizer bypass. For example, a disallowed <xmp> wrapper can be used to smuggle <script> or event-handler payloads through sanitization.

The README also appears to contradict the implementation. In the "Discarding the entire contents of a disallowed tag" section, the documented exception list names only style, script, textarea, and option, and does not mention xmp.

PoC

Tested locally against [email protected] on Node.js v25.2.1.

  1. Install the package:
npm install sanitize-html
  1. Run the following script:
const sanitizeHtml = require('sanitize-html');

console.log(sanitizeHtml('<xmp><script>alert(1)</script></xmp>'));
console.log(sanitizeHtml('<xmp><img src=x onerror=alert(1)></xmp>'));
console.log(sanitizeHtml('<xmp><svg><script>alert(1)</script></svg></xmp>'));
  1. Observed output:
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg><script>alert(1)</script></svg>
  1. Render any of the returned strings in a browser context that trusts sanitize-html output, for example:
const dirty = '<xmp><script>alert(1)</script></xmp>';
const clean = sanitizeHtml(dirty);

If clean is inserted into the DOM or stored and later rendered as trusted HTML, the attacker-controlled script executes.

Impact

This is a cross-site scripting vulnerability in the default sanitizer behavior. Any application that uses sanitize-html defaults and then renders the returned HTML as trusted output is impacted. A remote attacker who can submit HTML content can trigger execution of arbitrary JavaScript in another user's browser when that content is viewed.

Record
GHSA-rpr9-rxv7-x643
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 9.3

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of sanitize-html prior to 2.17.4 can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Record
CVE-2026-44990
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 9.3

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of sanitize-html prior to 2.17.4 can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Record
CVE-2026-44990
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-rpr9-rxv7-x643 9.3

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Summary

Under the default configuration, sanitize-html can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized output back to users.

Details

In [email protected], the default nonTextTags list includes only script, style, textarea, and option in index.js lines 138-142. That means disallowed xmp tags are not treated as "drop the entire contents" tags.

Later, in the ontext handler at index.js lines 569-577, the code special-cases textarea and xmp and appends their text content directly to the output without escaping:

} else if ((options.disallowedTagsMode === 'discard' || options.disallowedTagsMode === 'completelyDiscard') && (tag === 'textarea' || tag === 'xmp')) {
  result += text;
}

Because htmlparser2 treats xmp as a raw-text element, markup inside xmp is parsed as text on input but becomes live markup again once it is appended unescaped to the sanitized output.

This creates a default sanitizer bypass. For example, a disallowed <xmp> wrapper can be used to smuggle <script> or event-handler payloads through sanitization.

The README also appears to contradict the implementation. In the "Discarding the entire contents of a disallowed tag" section, the documented exception list names only style, script, textarea, and option, and does not mention xmp.

PoC

Tested locally against [email protected] on Node.js v25.2.1.

  1. Install the package:
npm install sanitize-html
  1. Run the following script:
const sanitizeHtml = require('sanitize-html');

console.log(sanitizeHtml('<xmp><script>alert(1)</script></xmp>'));
console.log(sanitizeHtml('<xmp><img src=x onerror=alert(1)></xmp>'));
console.log(sanitizeHtml('<xmp><svg><script>alert(1)</script></svg></xmp>'));
  1. Observed output:
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg><script>alert(1)</script></svg>
  1. Render any of the returned strings in a browser context that trusts sanitize-html output, for example:
const dirty = '<xmp><script>alert(1)</script></xmp>';
const clean = sanitizeHtml(dirty);

If clean is inserted into the DOM or stored and later rendered as trusted HTML, the attacker-controlled script executes.

Impact

This is a cross-site scripting vulnerability in the default sanitizer behavior. Any application that uses sanitize-html defaults and then renders the returned HTML as trusted output is impacted. A remote attacker who can submit HTML content can trigger execution of arbitrary JavaScript in another user's browser when that content is viewed.

Record
GHSA-rpr9-rxv7-x643
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
Show 4 moreShow less
OSVROOT-APP-NPM-CVE-2026-44990 9.3

CVE-2026-44990 in @rootio/sanitize-html - Patched by Root

Root has patched CVE-2026-44990 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-44990
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:11436-1 No score

golang-github-prometheus-prometheus-3.13.2-1.1 on GA media

These are all security issues fixed in the golang-github-prometheus-prometheus-3.13.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11436-1
Updated
2026-11-02
OSVSUSE-SU-2026:4585-1 No score

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

  • Security issues:

    • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
    • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
    • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
    • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
    • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
    • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
    • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
    • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
    • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
    • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
    • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
    • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
    • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
    • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

  • Bug fixes and changes:

    • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
    • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
    • Native Histograms are no longer experimental. They are fully supported for production workloads.
    • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
    • TSDB compaction speed optimized by improving the block merging algorithm.
    • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
    • Added new metrics to monitor the health of the rule evaluation engine.
    • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
    • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
    • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
    • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
    • Support exporting TSDB blocks directly to cloud storage via the admin API.
    • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
    • Significant query performance boost for high-cardinality regex matchers.
    • Introduce a new UI interface for safely deleting specific time series data directly.
    • Added dynamic relabeling actions to extract substrings using regex capture groups.
    • Fixed UI displaying incorrect time ranges after a timezone change.
    • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

grafana was updated to version 12.4.10:

  • Security issues:

    • CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
    • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)
    • CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)
    • CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973) *…
Record
SUSE-SU-2026:4585-1
Updated
2026-11-02
OSVSUSE-SU-2026:4606-1 No score

Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

  • Security issues:

    • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
    • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
    • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
    • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
    • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
    • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
    • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
    • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
    • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
    • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
    • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
    • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
    • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
    • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

  • Bug fixes and changes:

    • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
    • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
    • Native Histograms are no longer experimental. They are fully supported for production workloads.
    • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
    • TSDB compaction speed optimized by improving the block merging algorithm.
    • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
    • Added new metrics to monitor the health of the rule evaluation engine.
    • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
    • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
    • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
    • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
    • Support exporting TSDB blocks directly to cloud storage via the admin API.
    • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
    • Significant query performance boost for high-cardinality regex matchers.
    • Introduce a new UI interface for safely deleting specific time series data directly.
    • Added dynamic relabeling actions to extract substrings using regex capture groups.
    • Fixed UI displaying incorrect time ranges after a timezone change.
    • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0
Record
SUSE-SU-2026:4606-1
Updated
2026-11-02

Affected products

Show 18 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
sanitize-html
npm
 2.17.3 to 2.17.3
2.17.4
sanitize-html
npm
 2.17.3 up to 2.17.4
2.17.4
@rootio/sanitize-html
Root:npm
 before 2.17.2-root.io.1
2.17.2-root.io.12.12.1-root.io.12.12.1-root.io.22.17.2-root.io.2
sanitize-html
Root:npm
 before 2.12.1-aikido.2
2.12.1-aikido.22.17.2-aikido.2
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 3.13.2-150002.3.19.1
3.13.2-150002.3.19.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 12.4.10-150002.4.27.1
12.4.10-150002.4.27.1
mgr-push
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 5.2.5-150002.3.12.1
5.2.5-150002.3.12.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 5.2.10-150002.3.15.1
5.2.10-150002.3.15.1
spacewalk-client-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 5.2.7-150002.3.12.1
5.2.7-150002.3.12.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 5.2.17-150002.3.20.1
5.2.17-150002.3.20.1
Show 5 moreShow less
Affected packages
PackageAffectedFixed
venv-salt-minion
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 3006.0-150002.5.22.1
3006.0-150002.5.22.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 58 CVEs
 before 5.2.17-150002.3.20.1
5.2.17-150002.3.20.1
venv-salt-minion
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 58 CVEs
 before 3006.0-150002.5.22.1
3006.0-150002.5.22.1
golang-github-prometheus-prometheus
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 11 CVEs
 before 3.13.2-150100.4.40.2
3.13.2-150100.4.40.2
golang-github-prometheus-prometheus
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.13.2-1.1
3.13.2-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-44990 is a critical vulnerability (CVSS 9.3) in Apostrophecms Sanitize-html, published May 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in sanitize-html 2.17.4.

References

Show 170 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open