{"id":"EUVD-2026-60440","enisaUuid":"cbc501bc-0217-3db3-9992-e7fb9ef9c3b5","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.","datePublished":"Aug 17, 2026, 7:49:51 PM","dateUpdated":"Aug 18, 2026, 6:08:30 PM","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw\nhttps://github.com/apostrophecms/apostrophe/pull/5501\nhttps://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725\n","aliases":"CVE-2026-63670\nGHSA-jxwj-j7wr-gfrw\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"919c1293-fc0d-3758-ae32-65acec9ee28a","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 2.17.6"}],"enisaIdVendor":[{"id":"c0d6468f-9d25-3896-b167-bc16f2a48da4","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"86f68366-c805-3876-97e7-32e9501db60f","vulnerability":{"id":"GHSA-jxwj-j7wr-gfrw","description":"ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `\u003c/textarea/\u003e` solidus close","datePublished":"Sep 3, 2026, 8:07:16 PM","dateUpdated":"Sep 3, 2026, 8:07:16 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63670\nhttps://github.com/apostrophecms/apostrophe/pull/5501\nhttps://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725\nhttps://github.com/apostrophecms/apostrophe\n","enisa_id":"EUVD-2026-60440\n","aliases":"CVE-2026-63670\nGHSA-jxwj-j7wr-gfrw\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8c12fbf2-7d9a-3926-9412-71615c2f130c","vulnerability":{"id":"CVE-2026-63670","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.","datePublished":"Aug 17, 2026, 7:49:51 PM","dateUpdated":"Aug 18, 2026, 6:08:30 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw\nhttps://github.com/apostrophecms/apostrophe/pull/5501\nhttps://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725\n","enisa_id":"EUVD-2026-60440\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Nov 5, 2026, 7:15:58 AM","vulnerabilityProduct":[{"id":"73ed05a4-a1b1-390d-ac31-f98882271a4a","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 2.17.6"}],"vulnerabilityVendor":[{"id":"35545020-e41e-3186-93c4-8d982c066c5d","vendor":{"name":"apostrophecms"}}]}}],"enisaIdAdvisory":[{"id":"63761b1d-bfbf-3666-8aa0-7f5c9e9e0066","advisory":{"id":"WID-SEC-W-2026-3596","description":"IBM App Connect Enterprise: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.","datePublished":"Sep 27, 2026, 10:00:00 PM","dateUpdated":"Nov 1, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3596.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-3596\n","aliases":"CVE-2022-35948\nCVE-2026-13149\nCVE-2026-14257\nCVE-2026-15157\nCVE-2026-1527\nCVE-2026-16728\nCVE-2026-16729\nCVE-2026-18149\nCVE-2026-18540\nCVE-2026-19534\nCVE-2026-2391\nCVE-2026-45820\nCVE-2026-54272\nCVE-2026-63670\nCVE-2026-67213\nCVE-2026-67214\nCVE-2026-69152\nCVE-2026-69192\nCVE-2026-69198\nCVE-2026-73566\nCVE-2026-73646\nCVE-2026-77037\nCVE-2026-77063\nCVE-2026-77078\nCVE-2026-82333\nCVE-2026-82417\nCVE-2026-82562\nCVE-2026-83605\nCVE-2026-83606\nCVE-2026-83607\nCVE-2026-83608\nCVE-2026-83609\nCVE-2026-83610\nCVE-2026-83611\nCVE-2026-83612\nCVE-2026-83613\nCVE-2026-83614\nCVE-2026-83615\nCVE-2026-83616\nCVE-2026-83618\nCVE-2026-83619\nCVE-2026-84292\nCVE-2026-84371\nCVE-2026-84375\nCVE-2026-84890\nCVE-2026-84933\nCVE-2026-84947\nCVE-2026-84961\nCVE-2026-85008\nCVE-2026-85014\nCVE-2026-85024\nCVE-2026-85152\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"07b7ce8b-bbd8-3c1d-90ff-e766961cf95b","product":{"name":"IBM Business Automation Workflow","vendor":{"name":"IBM"}}},{"id":"126a9442-eb03-322f-967d-d4b24b4679fa","product":{"name":"App Connect Enterprise","vendor":{"name":"IBM"}}},{"id":"4f251418-833c-3fbe-a850-6f2f852b6cf4","product":{"name":"Oracle Linux","vendor":{"name":"Oracle Corporation"}}},{"id":"59e49cee-20d8-32d8-a9a5-ada15dab1413","product":{"name":"13.0.9.0","vendor":{"name":"IBM"}}},{"id":"5fc9732f-beac-33ec-bcf5-eaad4b8af406","product":{"name":"for multiplatforms","vendor":{"name":"IBM"}}},{"id":"6149fcf6-f409-3550-8715-408fbcfd0b7d","product":{"name":"TXSeries","vendor":{"name":"IBM"}}},{"id":"bdee46b9-a477-3528-9be8-952bf9fcd6a4","product":{"name":"12.0.12.30","vendor":{"name":"IBM"}}},{"id":"cc0e223e-7625-359d-8296-dd00c8d08686","product":{"name":"IBM WebSphere Service Registry and Repository","vendor":{"name":"IBM"}}}]}}]}