CVE-2026-40186

A flaw was found in the sanitize-html package, a dependency of ApostropheCMS. A remote attacker could exploit a regression in sanitize-html versions prior to 2.17.2, which incorrectly handles entity decoding within textarea and option HTML elements. This allows an attacker to bypass the allowedTa...

ROOT-APP-NPM-CVE-2026-44990 CVE-2026-44990 in @rootio/sanitize-html - Patched by Root

Root has patched CVE-2026-44990 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-NSWG-ECO-154 NSWG-ECO-154 in @rootio/sanitize-html - Patched by Root

Root has patched NSWG-ECO-154 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2021-26539 CVE-2021-26539 in @rootio/sanitize-html - Patched by Root

Root has patched CVE-2021-26539 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2021-26540 CVE-2021-26540 in @rootio/sanitize-html - Patched by Root

Root has patched CVE-2021-26540 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-25887 CVE-2022-25887 in @rootio/sanitize-html - Patched by Root

Root has patched CVE-2022-25887 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2017-16016 CVE-2017-16016 in @rootio/sanitize-html - Patched by Root

Root has patched CVE-2017-16016 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2016-1000237 CVE-2016-1000237 in @rootio/sanitize-html - Patched by Root

Root has patched CVE-2016-1000237 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2019-25225 CVE-2019-25225 in @rootio/sanitize-html - Patched by Root

Root has patched CVE-2019-25225 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-21501 CVE-2024-21501 in @rootio/sanitize-html - Patched by Root

Root has patched CVE-2024-21501 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...

PT-2026-49160

Root has patched NSWG-ECO-154 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...

org.webjars.npm:github-com-daichirata-vue-sanitize (0.2.2), org.webjars.npm:github-com-daichirata-vue-sanitize- (0.2.2) potentially affected by CVE-2026-45011 via org.webjars.npm:sanitize-html (2.7.0)

org.webjars.npm:sanitize-html MAVEN version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sanitize-html and may be impacted: - org.webjars.npm:github-com-daichirata-vue-sanitize 0.2.2 -...

7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +1883 more potentially affected by CVE-2026-45011 via sanitize-html (>=2.1.0, <=2.17.3)

sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =1.0.0, =3.0.0, =1.3.0, =1.0.0, =0.2.0-a0, =1.0.0, =0.0.1, =0.5.2 and more Source cves: CVE-2026-45011 Source advisory: SNYK:JS-SANITIZEHTML-16759743...

Improper Encoding or Escaping of Output

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the linkHref field handling. An...

GHSA-RPR9-RXV7-X643 Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Summary Under the default configuration, sanitize-html can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized...

Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS via the xmp raw-text passthrough. An attacker can...

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Summary Under the default configuration, sanitize-html can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized...

NPM: Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

NPM: Apostrophe has default XSS via xmp raw-text passthrough in sanitize-html vulnerability discovered by ? in WordPress Npm sanitize-html versions 2.17.3...

org.webjars.npm:github-com-daichirata-vue-sanitize (0.2.2), org.webjars.npm:github-com-daichirata-vue-sanitize- (0.2.2) potentially affected by CVE-2026-44990 via org.webjars.npm:sanitize-html (2.7.0)

org.webjars.npm:sanitize-html MAVEN version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sanitize-html and may be impacted: - org.webjars.npm:github-com-daichirata-vue-sanitize 0.2.2 -...

@nivinjoseph/n-config (2.0.4), @nivinjoseph/n-data (4.0.3) +53 more potentially affected by CVE-2026-44990 via sanitize-html (2.17.3)

sanitize-html NPM version 2.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @nivinjoseph/n-config 2.0.4 - @nivinjoseph/n-data 4.0.3 - @nivinjoseph/n-date 1.0.1 - @nivinjoseph/n-domain 3.0.6 - @nivinjoseph/n-eda...