Veille CVE

‹ Retour à la liste

CVE-2026-44990

9.3 Critique

Publiée le 12/06/2026 à 23:16 · Modifiée le 10/09/2026 à 15:20 · Analyse NVD reportée · Source : security-advisories@github.com

Description

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 9.3 Critique security-advisories@github.com CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
3.1 8.1 Élevée 0b0ca135-0b70-47e7-9f44-1890c2a1c46c CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Faiblesses (CWE)

Références

Ailleurs