sanitize-html XSS via xmp in < 2.17.4 (ApostropheCMS JS CMS)
CVE-2026-44990 Published on June 12, 2026

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

NVD

Vulnerability Analysis

CVE-2026-44990 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-44990. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2026-44990 has been classified to as a XSS vulnerability or weakness.


Products Associated with CVE-2026-44990

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-44990 are published in these products:

Apostrophecms Sanitize Html
 
Red Hat Multicluster Engine
 
Red Hat Acm
 
Red Hat Hummingbird
 
Red Hat Openshift Ai
 
Red Hat Openshift
 
Red Hat Openshift Devspaces
 
Red Hat Container Native Virtualization
 
Red Hat Quay
 
Red Hat Satellite
 

Affected Versions

apostrophecms sanitize-html: Red Hat Multicluster Engine for Kubernetes: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Hardened Images: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Container Platform 4: Red Hat OpenShift Dev Spaces: Red Hat OpenShift Virtualization 4: Red Hat Quay 3: Red Hat Satellite 6:

Exploit Probability

EPSS
0.32%
Percentile
23.89%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.