CVE catalog
CVE-2026-63670
ApostropheCMS is an open-source Node.js content…
ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.
- Severity
- Medium · CVSS 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.33% · Oct 27, 2026
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "sanitize-html",
"ecosystem": "npm",
"fixed_version": "2.17.6",
"provider_record_id": "GHSA-JXWJ-J7WR-GFRW"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
Observed:
References
- [https://github.com/advisories/GHSA-jxwj-j7wr-gfrw]
- [https://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725]
- [https://github.com/apostrophecms/apostrophe/pull/5501]
- [https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-63670]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3596.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]