{"id":"CVE-2026-63670","aliases":["GHSA-jxwj-j7wr-gfrw"],"url":"https://o3.security/vulnerability/CVE-2026-63670","summary":"ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close","details":"ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.","published":"2026-08-17T19:49:51.903Z","modified":"2026-08-20T03:30:26.745517418Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"sanitize-html","fixedVersion":"2.17.6"}],"fix":{"url":"https://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725","label":"apostrophecms/apostrophe@eae1fb2"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63670.json"},{"type":"ADVISORY","url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63670"},{"type":"FIX","url":"https://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725"},{"type":"FIX","url":"https://github.com/apostrophecms/apostrophe/pull/5501"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-20T03:30:26.745517418Z"}}