CVE-2026-40186

[CVE catalog]

A flaw was found in the `sanitize-html` package, a dependency of ApostropheCMS. A remote attacker could exploit a regression in `sanitize-html` versions prior to 2.17.2, which incorrectly handles entity decoding within `textarea` and `option` HTML elements. This allows an attacker to bypass the `allowedTags` filter by using entity encoding, leading to the injection of arbitrary HTML tags, including Cross-Site Scripting (XSS) payloads. Successful exploitation could result in arbitrary code execution in the context of the user's browser. sanitize-html: ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements This Moderate flaw in the `sanitize-html` package, a dependency for several Red Hat products, enables Cross-Site Scripting (XSS) attacks. The vulnerability occurs when entity-encoded HTML within `textarea` or `option` elements bypasses the `allowedTags` filter. Exploitation is limited to non-default configurations where these elements are explicitly permitted in `allowedTags`, reducing the immediate risk to typical Red Hat deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Published

Apr 15, 2026, 8:15:12 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.25% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "apostrophecms",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "sanitize-html",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "apostrophecms",
      "ranges": [],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40186",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-40186",
      "provider_updated_at": "2026-10-26T21:10:00.170"
    },
    {
      "name": "sanitize-html",
      "ranges": [
        {
          "fixed": "",
          "introduced": "",
          "last_affected": "2.17.1",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40186",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-40186",
      "provider_updated_at": "2026-10-26T21:10:00.170"
    }
  ]
}