ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

Summary A mutation-XSS / allowedTags bypass: when textarea or xmp is included in allowedTags, an input containing a literal a solidus right after the RCDATA end-tag name lets non-allowed markup such as pass through sanitizeHtml live and unescaped, even though img/onerror are not in the allowlist....

NPM: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

NPM: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close vulnerability discovered by ? in WordPress Npm sanitize-html versions = 2.17.5...

GHSA-JXWJ-J7WR-GFRW ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

Summary A mutation-XSS / allowedTags bypass: when textarea or xmp is included in allowedTags, an input containing a literal a solidus right after the RCDATA end-tag name lets non-allowed markup such as pass through sanitizeHtml live and unescaped, even though img/onerror are not in the allowlist....

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS (open-source Node.js CMS) is vulnerable to a mutation XSS in sanitizeHtml() (packages/sanitize-html/index.js) prior to version 2.17.6 . When textarea or xmp is included in allowedTags, a literal solidus after the raw-text end-tag name (e.g., ) is treated as text by htmlparser2 , and...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-40186: Improper Neutralization of Input During Web Page Generation

ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of the ApostropheCMS-maintained sanitize-html package bypasses allowedTags enforcement for text inside nonTextTagsArray elements textarea and option...

Express XSS Sanitizer prototype contamination vulnerability

Express XSS Sanitizer is a personal development by AhmedAdelFahim to clean user input data in req.body, req.query, req.headers and req.params to prevent cross-site scripting XSS attacks. express XSS Sanitizer A prototype contamination vulnerability exists in versions prior to 1.1.3, which stems...

express-xss-sanitizer vulnerable to Prototype Pollution via allowedTags attribute

The package express-xss-sanitizer before 1.1.3 is vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization...

CVE-2022-21169

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization...

CVE-2022-21169 Prototype Pollution

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization...

CVE-2022-21169

Express-XSS-Sanitizer prior to 1.1.3 is vulnerable to Prototype Pollution via the allowedTags attribute, enabling bypass of XSS sanitization. Affected: express-xss-sanitizer pre-1.1.3. Root cause: prototype contamination affecting sanitization. Impact: potential bypass of input sanitization and r...

CVE-2022-21169

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization...

CVE-2022-21169: Improperly Controlled Modification of Object Prototype Attributes

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization...

Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag. Proof of Concept js var sanitizeHtml = require'sanitize-html'; var dirty = '!/textarea!'; var clean = sanitizeHtmldirty, allowedTags: 'textarea' ; console.logclean; // !!...

GHSA-XC6G-GGRC-QQ4R Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag. Proof of Concept js var sanitizeHtml = require'sanitize-html'; var dirty = '!/textarea!'; var clean = sanitizeHtmldirty, allowedTags: 'textarea' ; console.logclean; // !!...

Cross-Site Scripting

Overview Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag. Proof of Concept var sanitizeHtml = require'sanitize-html'; var dirty = '!/textarea!'; var clean = sanitizeHtmldirty, allowedTags: 'textarea' ; console.logclean; /...