Executive brief
ApostropheCMS sanitize-html, a library used to clean user-provided web content, contains a flaw that allows malicious code to bypass its security filters. By wrapping malicious scripts in a specific HTML tag, an attacker can trick the system into treating dangerous code as safe text. If this content is then displayed to other users, it could allow attackers to steal session information, hijack accounts, or perform unauthorized actions on the website.
Technical details
A cross-site scripting (XSS) vulnerability exists in sanitize-html prior to version 2.17.4 due to a sanitizer bypass in the default 'disallowedTagsMode: discard' configuration. The root cause is located in the ontext handler (index.js), which fails to escape text content within 'xmp' tags, appending it directly to the output. While htmlparser2 treats 'xmp' as raw text during input parsing, the library's failure to escape this content upon output allows nested tags (such as <script> or event handlers) to become live markup. An unauthenticated remote attacker can exploit this by submitting specially crafted HTML, leading to stored XSS when the sanitized output is rendered in a browser. The issue is resolved in version 2.17.4.
Affected products
- ApostropheCMS sanitize-html < 2.17.4
Timeline
- 2026-05-13: advisory: GitHub security advisory published by maintainers
- 2026-06-12: disclosed: NVD publication date
- 2026-06-12: patched: Version 2.17.4 released to address the bypass