{"id":"CVE-2026-44990","title":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API","summary":"ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-contro…","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwe":["CWE-79"],"vendor":"apostrophecms","product":"sanitize-html","affected":["sanitize-html < 2.17.4"],"patched":["advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.15","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","container_native_virtualization 4.19","container_native_virtualization 4.20","openshift_container_platform 4.22","openshift_dev_spaces 3.29","quay 3.12","quay 3.15","quay 3.16","quay 3.1","quay 3.9","satellite 6.18","satellite 6.19","multicluster_engine_for_kubernetes 2.11","multicluster_engine_for_kubernetes 2.17","multicluster_engine_for_kubernetes 2.1","multicluster_engine_for_kubernetes 2.6","multicluster_engine_for_kubernetes 2.8","multicluster_engine_for_kubernetes 2.9"],"published":"2026-06-12","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:20:17.020","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44990","references":[{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36883","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40262","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41031","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41055","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41064","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42146","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43052","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46598","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46685","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46885","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46903","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:47735","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:47737","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48124","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:51196","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:51197","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:51349","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57191","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57194","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59593","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60386","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60441","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:63046","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:63103","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-44990","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488565","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44990.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40119","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40138","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44990"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44990"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-06-15T13:04:32.468259Z"},"epss":0.00601,"epssPercentile":0.47493,"scores":{"nvd":9.3,"vendor":8.1,"cna":9.3},"ingestedAt":"2026-07-16T14:55:12.373Z","slug":"CVE-2026-44990","body":"## Overview\n\nApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:41064** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41064)\n- **RHSA-2026:47737** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:47737)\n- **RHSA-2026:36882** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36882)\n- **RHSA-2026:46903** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-07-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:46903)\n- **RHSA-2026:57191** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57191)\n- **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386)\n- **RHSA-2026:46685** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.19 · released 2026-07-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:46685)\n- **RHSA-2026:46598** · Red Hat · fixed in: Red Hat Container Native Virtualization 4.20 · released 2026-07-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:46598)\n- **RHSA-2026:60441** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60441)\n- **RHSA-2026:48124** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.29 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48124)\n- **RHSA-2026:42146** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42146)\n- **Red Hat VEX** · Important · affected: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Satellite 6 · no fix planned: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Satellite 6 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44990.json)","depth":"abyssal","depthScore":63,"depthScoreParts":{"impact":51.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201664,"id":"CVE-2026-44990","ts":1789399595115,"field":"exploit_available","old":"false","new":"true"},{"seq":200396,"id":"CVE-2026-44990","ts":1789397208629,"field":"exploit_available","old":"true","new":"false"},{"seq":198320,"id":"CVE-2026-44990","ts":1789391831204,"field":"exploit_available","old":"false","new":"true"},{"seq":196113,"id":"CVE-2026-44990","ts":1789383479047,"field":"exploit_available","old":"true","new":"false"},{"seq":195042,"id":"CVE-2026-44990","ts":1789380360411,"field":"exploit_available","old":"false","new":"true"},{"seq":193829,"id":"CVE-2026-44990","ts":1789378326679,"field":"exploit_available","old":"true","new":"false"},{"seq":192616,"id":"CVE-2026-44990","ts":1789376310220,"field":"exploit_available","old":"false","new":"true"},{"seq":191403,"id":"CVE-2026-44990","ts":1789373239539,"field":"exploit_available","old":"true","new":"false"},{"seq":190188,"id":"CVE-2026-44990","ts":1789369196437,"field":"exploit_available","old":"false","new":"true"},{"seq":188975,"id":"CVE-2026-44990","ts":1789368099412,"field":"exploit_available","old":"true","new":"false"},{"seq":187758,"id":"CVE-2026-44990","ts":1789365054085,"field":"exploit_available","old":"false","new":"true"},{"seq":186545,"id":"CVE-2026-44990","ts":1789363091722,"field":"exploit_available","old":"true","new":"false"},{"seq":185331,"id":"CVE-2026-44990","ts":1789361011972,"field":"exploit_available","old":"false","new":"true"},{"seq":184118,"id":"CVE-2026-44990","ts":1789358003302,"field":"exploit_available","old":"true","new":"false"},{"seq":182369,"id":"CVE-2026-44990","ts":1789354154234,"field":"exploit_available","old":"false","new":"true"},{"seq":181162,"id":"CVE-2026-44990","ts":1789352996973,"field":"exploit_available","old":"true","new":"false"},{"seq":179955,"id":"CVE-2026-44990","ts":1789350065327,"field":"exploit_available","old":"false","new":"true"},{"seq":178748,"id":"CVE-2026-44990","ts":1789347932064,"field":"exploit_available","old":"true","new":"false"},{"seq":177541,"id":"CVE-2026-44990","ts":1789346217614,"field":"exploit_available","old":"false","new":"true"},{"seq":176334,"id":"CVE-2026-44990","ts":1789342836996,"field":"exploit_available","old":"true","new":"false"},{"seq":175788,"id":"CVE-2026-44990","ts":1789338621317,"field":"exploit_available","old":"false","new":"true"},{"seq":175658,"id":"CVE-2026-44990","ts":1789338462937,"field":"exploit_available","old":"true","new":"false"},{"seq":174453,"id":"CVE-2026-44990","ts":1789334641597,"field":"exploit_available","old":"false","new":"true"},{"seq":173248,"id":"CVE-2026-44990","ts":1789333327905,"field":"exploit_available","old":"true","new":"false"},{"seq":172062,"id":"CVE-2026-44990","ts":1789330939414,"field":"exploit_available","old":"false","new":"true"},{"seq":170876,"id":"CVE-2026-44990","ts":1789328456913,"field":"exploit_available","old":"true","new":"false"},{"seq":169671,"id":"CVE-2026-44990","ts":1789326964868,"field":"exploit_available","old":"false","new":"true"},{"seq":168466,"id":"CVE-2026-44990","ts":1789323528796,"field":"exploit_available","old":"true","new":"false"},{"seq":167261,"id":"CVE-2026-44990","ts":1789319422476,"field":"exploit_available","old":"false","new":"true"},{"seq":166056,"id":"CVE-2026-44990","ts":1789318390128,"field":"exploit_available","old":"true","new":"false"},{"seq":164851,"id":"CVE-2026-44990","ts":1789315610725,"field":"exploit_available","old":"false","new":"true"},{"seq":163646,"id":"CVE-2026-44990","ts":1789313328277,"field":"exploit_available","old":"true","new":"false"},{"seq":162441,"id":"CVE-2026-44990","ts":1789311750612,"field":"exploit_available","old":"false","new":"true"},{"seq":161236,"id":"CVE-2026-44990","ts":1789308352518,"field":"exploit_available","old":"true","new":"false"},{"seq":160741,"id":"CVE-2026-44990","ts":1789304279628,"field":"exploit_available","old":"false","new":"true"},{"seq":158579,"id":"CVE-2026-44990","ts":1789299345720,"field":"exploit_available","old":"true","new":"false"},{"seq":157543,"id":"CVE-2026-44990","ts":1789296502733,"field":"exploit_available","old":"false","new":"true"},{"seq":156338,"id":"CVE-2026-44990","ts":1789294453886,"field":"exploit_available","old":"true","new":"false"},{"seq":155133,"id":"CVE-2026-44990","ts":1789292700277,"field":"exploit_available","old":"false","new":"true"},{"seq":153928,"id":"CVE-2026-44990","ts":1789289430696,"field":"exploit_available","old":"true","new":"false"},{"seq":152578,"id":"CVE-2026-44990","ts":1789281324680,"field":"exploit_available","old":"false","new":"true"},{"seq":150140,"id":"CVE-2026-44990","ts":1789275906364,"field":"exploit_available","old":"true","new":"false"},{"seq":149107,"id":"CVE-2026-44990","ts":1789273615099,"field":"exploit_available","old":"false","new":"true"},{"seq":148074,"id":"CVE-2026-44990","ts":1789270951968,"field":"exploit_available","old":"true","new":"false"},{"seq":146114,"id":"CVE-2026-44990","ts":1789269209500,"field":"exploit_available","old":"false","new":"true"},{"seq":145017,"id":"CVE-2026-44990","ts":1789266179116,"field":"exploit_available","old":"true","new":"false"},{"seq":143921,"id":"CVE-2026-44990","ts":1789262508649,"field":"exploit_available","old":"false","new":"true"},{"seq":142757,"id":"CVE-2026-44990","ts":1789261271066,"field":"exploit_available","old":"true","new":"false"},{"seq":141593,"id":"CVE-2026-44990","ts":1789258656906,"field":"exploit_available","old":"false","new":"true"},{"seq":140395,"id":"CVE-2026-44990","ts":1789256464533,"field":"exploit_available","old":"true","new":"false"}]}