Read the docs
TI-2026-32848 Aliases CVE-2026-44990GHSA-rpr9-rxv7-x643

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Priority HIGH 75CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 35 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00684 52nd percentileScored 2026-11-07
Fix Partial sanitize-html (apostrophecms): 2.17.4sanitize-html (npm): 2.17.4Red Hat: 39 advisoriesRed Hat: 35 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
apostrophecmssanitize-htmlbefore 2.17.42.17.4Patch availableCNA
—sanitize-html (npm)2.17.3 to before 2.17.42.17.4Patch availableGHSA-rpr9-rxv7-x643
  • sanitize-html Vendorapostrophecms Affected before 2.17.4 Fixed in 2.17.4 Patch available CNA
  • sanitize-html (npm) Vendor— Affected 2.17.3 to before 2.17.4 Fixed in 2.17.4 Patch available GHSA-rpr9-rxv7-x643

Remediation

  • Fix · CNA sanitize-html (apostrophecms) Fixed in 2.17.4
  • Fix · GHSA-rpr9-rxv7-x643 sanitize-html (npm) Fixed in 2.17.4 Advisory →

Red Hat 39 advisories

  • RHSA-2026:82813 Released 2026-10-22 · Red Hat rating Important
    OpenShift Container Platform 4.15.70 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kube-metrics-server-rhel8, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel9 +23
  • RHSA-2026:77316 Released 2026-10-15 · Red Hat rating Important
    OpenShift Container Platform 4.12.100 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8, registry.redhat.io/openshift4/ose-cluster-autoscaler-operator, registry.redhat.io/openshift4/ose-console +5
  • RHSA-2026:77321 Released 2026-10-15 · Red Hat rating Important
    OpenShift Container Platform 4.13.72 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8, registry.redhat.io/openshift4/ose-cluster-autoscaler-operator +10
Show 36 more Red Hat advisories
  • RHSA-2026:73869 Released 2026-10-08 · Red Hat rating Important
    OpenShift Container Platform 4.14.75 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:70617 Released 2026-10-01 · Red Hat rating Important
    OpenShift Container Platform 4.18.56 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator +47
  • RHSA-2026:70587 Released 2026-10-01 · Red Hat rating Important
    OpenShift Container Platform 4.17.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:67936 Released 2026-09-24 · Red Hat rating Important
    OpenShift Container Platform 4.16.71 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:66371 Released 2026-09-16 · Red Hat rating Important
    OpenShift Container Platform 4.19.47 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9 +8
  • RHSA-2026:63046 Released 2026-09-08 · Red Hat rating Important
    OpenShift Container Platform 4.21.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9, registry.redhat.io/openshift4/ose-cluster-autoscaler-rhel9-operator +6
  • RHSA-2026:63103 Released 2026-09-08 · Red Hat rating Important
    OpenShift Container Platform 4.20.37 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-prometheus-rhel9 +1
  • RHSA-2026:60441 Released 2026-09-01 · Red Hat rating Important
    OpenShift Container Platform 4.22.12 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator +23
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
  • RHSA-2026:59593 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.17.2 security update
    • multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +6
  • RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.5 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
  • RHSA-2026:57191 Released 2026-08-19 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
  • RHSA-2026:54395 Released 2026-08-12 · Red Hat rating Important
    Red Hat Quay 3.17.4
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:51349 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:51197 Released 2026-08-06 · Red Hat rating Important
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:51196 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:48124 Released 2026-07-29 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.29.1 Release.
    • Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +2
  • RHSA-2026:47737 Released 2026-07-29 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.10 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +6
  • RHSA-2026:47735 Released 2026-07-29 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.8.9 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9 +5
  • RHSA-2026:47451 Released 2026-07-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:47388 Released 2026-07-28 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.10.4 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:46903 Released 2026-07-27 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:46885 Released 2026-07-27 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.10.4 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:46685 Released 2026-07-27 · Red Hat rating Important
    OpenShift Virtualization v4.19 Images
    • Red Hat Container Native Virtualization 4.19 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:46598 Released 2026-07-27 · Red Hat rating Important
    OpenShift Virtualization v4.20 Images
    • Red Hat Container Native Virtualization 4.20 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:43052 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.12.20
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:42796 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.15.6
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:42146 Released 2026-07-20 · Red Hat rating Important
    Red Hat Quay 3.12.20
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:41066 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.16.5
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:41064 Released 2026-07-16 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.10 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9
  • RHSA-2026:41055 Released 2026-07-16 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.12 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator
  • RHSA-2026:41031 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.10.24
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:40262 Released 2026-07-15 · Red Hat rating Important
    Red Hat Quay 3.9.24
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:36883 Released 2026-07-08 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.5 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator
  • RHSA-2026:36882 Released 2026-07-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:41064
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:47737
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:36882
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:46903
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:57191
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Red Hat Container Native Virtualization 4.19Fixed RHSA-2026:46685
Red Hat Container Native Virtualization 4.20Fixed RHSA-2026:46598
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:77316
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:77321
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:73869
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:82813
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:67936
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:70587
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:70617
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:66371
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:63103
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:63046
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:60441
Red Hat OpenShift Dev Spaces 3.29Fixed RHSA-2026:48124
Red Hat Quay 3.10Fixed RHSA-2026:41031
Red Hat Quay 3.12Fixed RHSA-2026:42146, RHSA-2026:43052
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:42796
Red Hat Quay 3.16Fixed RHSA-2026:41066
Red Hat Quay 3.17Fixed RHSA-2026:54395
Red Hat Quay 3.9Fixed RHSA-2026:40262
Red Hat Satellite 6.18Fixed RHSA-2026:51349
Red Hat Satellite 6.19Fixed RHSA-2026:51196, RHSA-2026:51197
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:46885
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:57194
multicluster engine for Kubernetes 2.17Fixed RHSA-2026:59593
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:41055
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:47735
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:36883
Not affected: 34 products
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Hardened Images
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.29
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.9
  • Red Hat Satellite 6
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.17
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44990
  2. 2026-10-03 Alias added: GHSA-rpr9-rxv7-x643
  3. 2026-10-09 Fix available: RHSA-2026:73869 · Red Hat
  4. 2026-10-09 Fix available: Red Hat OpenShift Container Platform 4.14 · Red Hat
  5. 2026-10-16 Fix available: RHSA-2026:77316 · Red Hat
  6. 2026-10-16 Fix available: RHSA-2026:77321 · Red Hat
  7. 2026-10-16 Fix available: Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13 · Red Hat
  8. 2026-10-23 Fix available: RHSA-2026:82813 · Red Hat
  9. 2026-10-23 Fix available: Red Hat OpenShift Container Platform 4.15 · Red Hat
  10. 2026-10-30 Affected versions changed · Red Hat

References

Advisory 1

Other 4

  • TI-2026-25223 ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction CVSS 3.1CRITICAL 10.0
  • TI-2026-38664 @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag CVSS 3.1HIGH 8.7
  • TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
  • TI-2026-76992 Unauthenticated resource exhaustion via ApostropheCMS import routes CVSS 3.1HIGH 7.5
  • TI-2026-76974 ApostropheCMS leaves rejected CSV uploads in temporary directory CVSS 3.1HIGH 7.5
  • TI-2026-38665 Prototype pollution in apostrophecms apostrophe CVSS 3.1CRITICAL 9.1
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences