CVE-2026-63670

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 2.17.6

Description The sanitizeHtml() function in packages/sanitize-html/index.js allows disallowed executable markup to pass through when textarea or xmp are included in allowedTags. This occurs because a literal solidus following the raw-text end-tag name is treated as text by htmlparser2, and the ontext handler emits this content without escaping. Consequently, a browser may parse subsequent img onerror markup as active HTML, leading to a Mutation-XSS (Cross-Site Scripting where the browser's HTML parsing differs from the sanitizer's parsing).

Recommendations Update to version 2.17.6.