CVE-2026-44990
EUVD-2026-3656612.06.2026, 21:16
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | multicluster engine for Kubernetes 2.1 | 1784312384 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.11 | 1786911977 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.17 | 1786668856 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.6 | 1783351002 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.8 | 1785078604 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.9 | 1783348181 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.11 | 1783350952 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.13 | 1785078581 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | 1783451729 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | 1784578812 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | 1786908361 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | 1787335105 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Container Native Virtualization 4.19 | 1784844382 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Container Native Virtualization 4.20 | 1784629964 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | 1788350963 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | 1788359934 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | 1787746382 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.29 | 1784737150 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.10 | 1783750447 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.12 | 1783751865 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.12 | 1784353904 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.15 | 1784351966 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.16 | 1783955846 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.9 | 1784125838 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.18 | 1785922764 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.19 | 1785956497 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.19 | 1785937325 ≤ 𝑥 < * | ADP |
| apostrophecms | sanitize-html | 𝑥 < 2.17.4 | CNA |
References