CVE-2026-44990: sanitize-html XSS Vulnerability

CVE-2026-44990 Overview

CVE-2026-44990 is a sanitizer bypass vulnerability in sanitize-html, a library used by ApostropheCMS to clean untrusted HTML input. Versions prior to 2.17.4 fail to neutralize attacker-controlled content placed inside a disallowed xmp element. Under the default disallowedTagsMode: 'discard' configuration, malicious markup escapes sanitization and reaches the rendered DOM as live HTML or JavaScript. Applications that store and re-render sanitized output back to users become vectors for stored Cross-Site Scripting (XSS) [CWE-79]. The flaw affects ApostropheCMS deployments that rely on sanitize-html for user-generated content workflows.

Critical Impact
Attackers can inject persistent JavaScript into pages that render sanitized user content, enabling session theft, account takeover, and arbitrary actions in victim browsers.

Affected Products

ApostropheCMS deployments using sanitize-html versions prior to 2.17.4
sanitize-html library versions before 2.17.4
Any Node.js application invoking sanitize-html with the default disallowedTagsMode: 'discard' configuration

Discovery Timeline

2026-06-12 - CVE-2026-44990 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-44990

Vulnerability Analysis

The vulnerability resides in how sanitize-html processes the legacy xmp HTML element. The xmp tag historically rendered its contents as preformatted, literal text without parsing inner markup. Modern HTML parsers still treat xmp content as raw text inside the element, but browsers render the raw contents directly when the surrounding xmp tags are stripped.

When sanitize-html runs with disallowedTagsMode: 'discard', it removes the xmp wrapper but preserves the inner text verbatim. That inner text, which the parser never treated as markup, now sits in the output stream as unencoded HTML. Once a browser re-parses the sanitized output, the previously inert content executes as live tags or scripts.

Root Cause

The root cause is incomplete encoding when discarding a tag whose content model is raw text. The sanitizer trusts that raw-text content cannot contain executable markup. That assumption breaks once the wrapping element is removed and the inner string is re-inserted into a normal parsing context.

Attack Vector

An attacker submits content containing an xmp block with attacker-controlled HTML inside. The application passes the input through sanitize-html, stores the result, and later renders it in a page viewed by other users. Exploitation is network-based and requires the victim to load the rendered page, satisfying the user-interaction requirement. The scope change reflects that injected script executes in the origin of the hosting application, affecting users beyond the attacker.

No verified public proof-of-concept code is published. Refer to the GitHub Security Advisory GHSA-rpr9-rxv7-x643 for technical details from the maintainers.

Detection Methods for CVE-2026-44990

Indicators of Compromise

Stored content fields containing <xmp> tags wrapping <script>, <img onerror=>, or event-handler attributes
Outbound requests from user browsers to unfamiliar domains shortly after loading pages with user-generated content
Unexpected DOM mutations or script execution on pages rendering sanitized HTML

Detection Strategies

Audit stored content in ApostropheCMS collections for the literal substring xmp followed by HTML-like tokens
Inspect package-lock.json and yarn.lock for sanitize-html versions below 2.17.4
Add Content Security Policy (CSP) violation reporting to surface inline script execution from user-generated content

Monitoring Recommendations

Log and review HTTP POST and PUT payloads to ApostropheCMS content endpoints for the <xmp> token
Monitor authentication and session APIs for anomalous activity originating from authenticated user sessions
Track web application firewall (WAF) alerts for cross-site scripting signatures targeting CMS endpoints

How to Mitigate CVE-2026-44990

Immediate Actions Required

Upgrade sanitize-html to version 2.17.4 or later across all dependent applications
Rebuild and redeploy ApostropheCMS instances after dependency upgrade to ensure the patched library loads
Review historical user-generated content for stored payloads containing xmp constructs and purge or re-sanitize affected records

Patch Information

Version 2.17.4 of sanitize-html patches the issue by correctly handling content inside disallowed raw-text elements. See the GitHub Security Advisory GHSA-rpr9-rxv7-x643 for upstream remediation guidance.

Workarounds

Add xmp to an explicit allow-list with strict text-only handling and a transform that HTML-encodes its inner contents before discarding the wrapper
Deploy a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins
Apply server-side output encoding on any field that previously stored content sanitized by an unpatched sanitize-html

bash

# Upgrade sanitize-html to the patched release
npm install sanitize-html@^2.17.4

# Verify the installed version
npm ls sanitize-html