CVE-2026-63670
Received Received - Intake

ApostropheCMS HTML Sanitization Flaw Allows XSS

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-63670
EUVD
EUVD-2026-60440

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
sanitize-html sanitize-html to 2.17.5 (exc)
htmlparser2 htmlparser2 From 12.0.0 (inc)
htmlparser2 htmlparser2 to 11.0.0 (exc)
apostrophecms apostrophe to 2.17.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS versions before 2.17.6 have an XSS vulnerability in the sanitizeHtml() function. When textarea or xmp tags are allowed, an attacker can bypass sanitization by using malformed closing tags like </textarea/> followed by malicious markup such as <img src=x onerror=...>. The htmlparser2 library incorrectly treats the solidus after the tag name as text, allowing the malicious content to pass through unescaped. Browsers then parse the injected script as active HTML.

Detection Guidance

Check ApostropheCMS version with npm list apostrophe or grep package.json. If version is below 2.17.6, the system is vulnerable. Inspect sanitize-html configurations for allowedTags including textarea or xmp.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of a user's browser session. If you use ApostropheCMS with configurations that allow textarea or xmp tags, an attacker could inject malicious scripts to steal cookies, session tokens, or sensitive data. The attack requires user interaction, such as clicking a link or visiting a crafted page, but could lead to account takeover or data breaches.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding protected health information. Organizations may face compliance violations if exploited, potentially resulting in fines or legal penalties. The risk is higher for systems handling sensitive user data.

Mitigation Strategies

Upgrade ApostropheCMS to version 2.17.6 or higher. Ensure Node.js is updated to version 22.12.0 or higher. Review and adjust sanitize-html allowedTags to exclude textarea and xmp if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63670. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart