{"id":"CVE-2026-40186","sourceIdentifier":"security-advisories@github.com","published":"2026-04-15T21:17:27.523","lastModified":"2026-10-26T21:10:00.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of the ApostropheCMS-maintained sanitize-html package bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). ApostropheCMS version 4.28.0 is affected through its dependency on the vulnerable sanitize-html version. The code at packages/sanitize-html/index.js:569-573 incorrectly assumes that htmlparser2 does not decode entities inside these elements and skips escaping, but htmlparser2 10.x does decode entities before passing text to the ontext callback. As a result, entity-encoded HTML is decoded by the parser and then written directly to the output as literal HTML characters, completely bypassing the allowedTags filter. An attacker can inject arbitrary tags including XSS payloads through any allowed option or textarea element using entity encoding. This affects non-default configurations where option or textarea are included in allowedTags, which is common in form builders and CMS platforms. This issue has been fixed in version 2.17.2 of sanitize-html and 4.29.0 of ApostropheCMS."},{"lang":"es","value":"ApostropheCMS es un sistema de gestión de contenido de código abierto basado en Node.js. Una regresión introducida en el commit 49d0bb7, incluida en las versiones 2.17.1 del paquete sanitize-html mantenido por ApostropheCMS, omite la aplicación de allowedTags para el texto dentro de los elementos nonTextTagsArray (textarea y option). La versión 4.28.0 de ApostropheCMS se ve afectada a través de su dependencia de la versión vulnerable de sanitize-html. El código en packages/sanitize-html/index.js:569-573 asume incorrectamente que htmlparser2 no decodifica entidades dentro de estos elementos y omite el escape, pero htmlparser2 10.x sí decodifica entidades antes de pasar el texto a la devolución de llamada ontext. Como resultado, el HTML codificado por entidad es decodificado por el analizador y luego se escribe directamente en la salida como caracteres HTML literales, omitiendo completamente el filtro allowedTags. Un atacante puede inyectar etiquetas arbitrarias, incluyendo cargas útiles de XSS, a través de cualquier elemento option o textarea permitido utilizando codificación de entidades. Esto afecta a configuraciones no predeterminadas donde option o textarea están incluidos en allowedTags, lo cual es común en constructores de formularios y plataformas CMS. Este problema ha sido solucionado en la versión 2.17.2 de sanitize-html y 4.29.0 de ApostropheCMS."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"apostrophecms","product":"apostrophe","versions":[{"version":">= 4.28.0, < 4.29.0","status":"affected"}]},{"vendor":"apostrophecms","product":"sanitize-html","versions":[{"version":">= 2.17.1, < 2.17.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-16T14:15:28.694337Z","id":"CVE-2026-40186","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apostrophecms:apostrophecms:4.29.0:*:*:*:*:*:*:*","matchCriteriaId":"BD79AAB3-1AE2-4E64-92AB-FD59A7D1F5E7"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:*","versionEndIncluding":"2.17.1","matchCriteriaId":"807F7A51-2171-47B7-A780-1DA41F5C8B8D"}]}]}],"references":[{"url":"https://github.com/apostrophecms/apostrophe/commit/7ca2d16237c72718ef7e5c7ae0458e6027ac4f64","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9mrh-v2v3-xpfm","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}