Description

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-17T20:16:45.000Z",
  "pubdate": "2026-08-17T20:16:45.000Z",
  "executiveSummary": "An improper neutralization of input vulnerability exists in ApostropheCMS prior to version 2.17.6 within the sanitizeHtml() function. The flaw allows authenticated or unauthenticated attackers, depending on the application context, to bypass HTML sanitization mechanisms and inject arbitrary executable markup into web pages. By leveraging specific allowed tags such as textarea or xmp in conjunction with a literal solidus and subsequent img onerror payloads, an attacker can achieve Cross-Site Scripting (XSS). This compromises the integrity and confidentiality of the web application, enabling potential session hijacking, data theft, or unauthorized actions performed in the context of a victim user's browser session. The risk implication is significant for applications relying on ApostropheCMS for user-generated content filtering. Mitigation requires updating the affected software to version 2.17.6 or later, where the underlying parsing and escaping logic has been appropriately corrected.",
  "technicalDetails": "The vulnerability resides in the sanitizeHtml() implementation located in packages/sanitize-html/index.js within ApostropheCMS prior to version 2.17.6. The root cause stems from a discrepancy between how the underlying HTML parser, htmlparser2, processes raw-text end-tag names and how modern web browsers parse active HTML content.\nSpecifically, when raw-text elements such as textarea or xmp are explicitly included in the allowedTags configuration, the parser encounters a parsing ambiguity. A literal solidus (slash) placed immediately after the raw-text end-tag name is incorrectly treated merely as plain text by htmlparser2. Consequently, the ontext event handler emits this raw content downstream without applying necessary HTML entity encoding or escaping.\nUpon rendering, web browsers parse the malformed structure differently, interpreting the subsequent payload—such as an img tag with an onerror event handler—as active, executable HTML rather than inert text. This discrepancy enables attackers to smuggle malicious JavaScript execution vectors past the sanitization boundary.\nThe attack flow proceeds as follows: 1) The attacker crafts an input payload containing a raw-text tag (textarea or xmp) combined with a literal solidus and an active markup payload like an img onerror vector. 2) The application passes this input to the vulnerable sanitizeHtml() function. 3) Due to parser misinterpretation in htmlparser2, the sanitization routine fails to neutralize the malicious sequence and passes the unescaped payload through. 4) The application stores or renders the output. 5) A victim's browser parses the injected markup, executing the attacker's script.\nThe vulnerability affects ApostropheCMS versions prior to 2.17.6. Exploitation relies on the application configuration permitting textarea or xmp tags within the sanitizeHtml options, network exposure to input vectors, and the execution of the payload within the context of a victim viewing the rendered content."
}