TI-2026-45295 Aliases CVE-2026-63670 GHSA-jxwj-j7wr-gfrw

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

MEDIUM 60CWE-79Published 2026-08-17 · Updated 2026-08-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00327 25th percentileScored 2026-11-07

Fix Fixed apostrophe (apostrophecms): 2.17.6sanitize-html (npm): 2.17.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
apostrophecms	apostrophe	before 2.17.6	2.17.6	Patch available	CNA
—	sanitize-html (npm)	before 2.17.6	2.17.6	Patch available	GHSA-jxwj-j7wr-gfrw

apostrophe Vendorapostrophecms Affected before 2.17.6 Fixed in 2.17.6 Patch available CNA
sanitize-html (npm) Vendor— Affected before 2.17.6 Fixed in 2.17.6 Patch available GHSA-jxwj-j7wr-gfrw

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:apostrophecms:apostrophecms::::::::	—	—	apostrophecms

cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* Versions — — ·apostrophecms

Remediation

Fix · CNA apostrophe (apostrophecms) Fixed in 2.17.6
Fix · GHSA-jxwj-j7wr-gfrw sanitize-html (npm) Fixed in 2.17.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-63670
2026-10-03 Alias added: GHSA-jxwj-j7wr-gfrw

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-63670

Other 4

TI-2026-25223 ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction CVSS 3.1CRITICAL 10.0
TI-2026-32848 Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` CVSS 3.1CRITICAL 9.3
TI-2026-38664 @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag CVSS 3.1HIGH 8.7
TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
TI-2026-76992 Unauthenticated resource exhaustion via ApostropheCMS import routes CVSS 3.1HIGH 7.5
TI-2026-76974 ApostropheCMS leaves rejected CSV uploads in temporary directory CVSS 3.1HIGH 7.5

See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences