CVE-2026-63670

6.1 Moyenne

Publiée le 17/08/2026 à 22:16 · Modifiée le 09/09/2026 à 23:11 · Analyse NVD reportée · Source : security-advisories@github.com

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.

Traduire en français

Produits concernés

apostrophecms apostrophe

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.1 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725
https://github.com/apostrophecms/apostrophe/pull/5501
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories