Open Source Node.js Content Management System Vulnerability in ApostropheCMS
CVE-2026-63670
6.1MEDIUM
What is CVE-2026-63670?
ApostropheCMS, an open-source Node.js content management system, has a vulnerability in its sanitizeHtml() function. Prior to version 2.17.6, the implementation allows disallowed executable markup due to improper handling of certain tags. Specifically, the inclusion of 'textarea' or 'xmp' in the allowedTags list permits a literal solidus after the raw-text end-tag name to be processed incorrectly. This leads to the ontext handler emitting unescaped content, allowing browsers to interpret subsequent elements such as 'img onerror' as active HTML, which could be exploited by attackers. The vulnerability has been addressed in version 2.17.6.
Affected Version(s)
apostrophe < 2.17.6