{"id":"EUVD-2026-60440","enisaUuid":"cbc501bc-0217-3db3-9992-e7fb9ef9c3b5","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.","datePublished":"Aug 17, 2026, 7:49:51 PM","dateUpdated":"Aug 18, 2026, 6:08:30 PM","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw\nhttps://github.com/apostrophecms/apostrophe/pull/5501\nhttps://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725\n","aliases":"CVE-2026-63670\nGHSA-jxwj-j7wr-gfrw\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"919c1293-fc0d-3758-ae32-65acec9ee28a","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 2.17.6"}],"enisaIdVendor":[{"id":"c0d6468f-9d25-3896-b167-bc16f2a48da4","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"86f68366-c805-3876-97e7-32e9501db60f","vulnerability":{"id":"GHSA-jxwj-j7wr-gfrw","description":"ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `\u003c/textarea/\u003e` solidus close","datePublished":"Sep 3, 2026, 8:07:16 PM","dateUpdated":"Sep 3, 2026, 8:07:16 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63670\nhttps://github.com/apostrophecms/apostrophe/pull/5501\nhttps://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725\nhttps://github.com/apostrophecms/apostrophe\n","enisa_id":"EUVD-2026-60440\n","aliases":"CVE-2026-63670\nGHSA-jxwj-j7wr-gfrw\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:00:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8c12fbf2-7d9a-3926-9412-71615c2f130c","vulnerability":{"id":"CVE-2026-63670","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.","datePublished":"Aug 17, 2026, 7:49:51 PM","dateUpdated":"Aug 18, 2026, 6:08:30 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw\nhttps://github.com/apostrophecms/apostrophe/pull/5501\nhttps://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725\n","enisa_id":"EUVD-2026-60440\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Oct 28, 2026, 7:15:21 AM","vulnerabilityProduct":[{"id":"73ed05a4-a1b1-390d-ac31-f98882271a4a","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 2.17.6"}],"vulnerabilityVendor":[{"id":"35545020-e41e-3186-93c4-8d982c066c5d","vendor":{"name":"apostrophecms"}}]}}],"enisaIdAdvisory":[]}