ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 9 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of the ApostropheCMS-maintained sanitize-html package bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). ApostropheCMS version 4.28.0 is affected through its dependency on the vulnerable sanitize-html version. The code at packages/sanitize-html/index.js:569-573 incorrectly assumes that htmlparser2 does not decode entities inside these elements and skips escaping, but htmlparser2 10.x does decode entities before passing text to the ontext callback. As a result, entity-encoded HTML is decoded by the parser and then written directly to the output as literal HTML characters, completely bypassing the allowedTags filter. An attacker can inject arbitrary tags including XSS payloads through any allowed option or textarea element using entity encoding. This affects non-default configurations where option or textarea are included in allowedTags, which is common in form builders and CMS platforms. This issue has been fixed in version 2.17.2 of sanitize-html and 4.29.0 of ApostropheCMS.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| apostrophecms | apostrophe | 4.28.0 to before 4.29.0 | 4.29.0 | Patch available | CNA |
| apostrophecms | sanitize-html | 2.17.1 to before 2.17.2 | 2.17.2 | Patch available | CNA |
| — | sanitize-html (npm) | 2.17.2 to before 2.17.3 | 2.17.3 | Patch available | GHSA-9mrh-v2v3-xpfm |
- apostrophe Vendorapostrophecms Affected 4.28.0 to before 4.29.0 Fixed in 4.29.0 Patch available CNA
- sanitize-html Vendorapostrophecms Affected 2.17.1 to before 2.17.2 Fixed in 2.17.2 Patch available CNA
- sanitize-html (npm) Vendor— Affected 2.17.2 to before 2.17.3 Fixed in 2.17.3 Patch available GHSA-9mrh-v2v3-xpfm
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apostrophecms:apostrophecms:4.29.0:*:*:*:*:*:*:* | 4.29.0 | Vulnerable | apostrophecms |
| cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:* | up to 2.17.1 | Vulnerable | apostrophecms |
- cpe:2.3:a:apostrophecms:apostrophecms:4.29.0:*:*:*:*:*:*:* Versions 4.29.0 Vulnerable ·apostrophecms
- cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:* Versions up to 2.17.1 Vulnerable ·apostrophecms
Remediation
- Fix · CNA apostrophe (apostrophecms) Fixed in 4.29.0
- Fix · CNA sanitize-html (apostrophecms) Fixed in 2.17.2
- Fix · GHSA-9mrh-v2v3-xpfm sanitize-html (npm) Fixed in 2.17.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40186
- 2026-10-03 Alias added: GHSA-9mrh-v2v3-xpfm
- 2026-10-30 Affected versions changed · Red Hat
References
More Apostrophecms vulnerabilities
- TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
- TI-2026-25222 ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware CVSS 3.1HIGH 8.1
- TI-2026-28738 Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions CVSS 3.1MEDIUM 5.3
- TI-2026-26246 ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API CVSS 3.1MEDIUM 5.3
- TI-2026-26247 ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context CVSS 3.1MEDIUM 5.4
- TI-2026-26237 ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint CVSS 3.1LOW 3.7
Sources
- CVE-2026-40186 · CVE Program
- CVE-2026-40186 · NVD
- FIRST EPSS
- GHSA-9mrh-v2v3-xpfm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-40186 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences