CVE-2026-63670: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMSto a version that resolves this vulnerability.Fixed in 2.17.6
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-63670?
The risk level of CVE-2026-63670 is categorized as medium with a severity score of 6.1.
How can I fix CVE-2026-63670?
To fix CVE-2026-63670, update ApostropheCMS to version 2.17.6 or later.
What type of vulnerability is CVE-2026-63670?
CVE-2026-63670 is classified as a Mutation-XSS vulnerability.
What components of ApostropheCMS are affected by CVE-2026-63670?
CVE-2026-63670 affects the sanitizeHtml() functionality in ApostropheCMS prior to version 2.17.6.
Is user interaction required for CVE-2026-63670 to be exploited?
Yes, user interaction is required for CVE-2026-63670 to be exploited, as noted in its characteristics.