CVE-2026-63670 Overview
CVE-2026-63670 is a stored cross-site scripting (XSS) vulnerability in ApostropheCMS, an open-source Node.js content management system. The flaw resides in the bundled packages/sanitize-html/index.js component. When textarea or xmp appear in the allowedTags list, sanitizeHtml() fails to strip disallowed executable markup. The parser htmlparser2 treats a literal solidus after the raw-text end-tag name as text, and the ontext handler emits that content without escaping. A browser then parses following img onerror markup as active HTML, executing attacker-supplied JavaScript in the victim's session. Version 2.17.6 remediates the issue.
Critical Impact
Authenticated or unauthenticated content submitters can inject persistent JavaScript that executes in other users' browsers, enabling session hijacking and privileged action abuse.
Affected Products
- ApostropheCMS versions prior to 2.17.6
- Deployments that include textarea or xmp in the allowedTags sanitizer configuration
- Downstream applications embedding the bundled sanitize-html package
Discovery Timeline
- 2026-08-17 - CVE-2026-63670 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-63670
Vulnerability Analysis
The vulnerability is a classic sanitizer bypass leading to cross-site scripting [CWE-79]. sanitizeHtml() relies on htmlparser2 to tokenize input HTML and decide which tags and attributes to strip. Raw-text elements such as textarea and xmp change the parser's tokenization mode. Inside these elements, the parser expects only text until a closing tag is encountered. When the sanitizer's allow-list permits either tag, malformed end-tag sequences slip through the tokenizer's state machine and are re-serialized without escaping. The result is sanitizer output that a real browser interprets differently than the sanitizer expected, breaking the security boundary the API promises.
Root Cause
The defect lies in a parser-differential between htmlparser2 and browser HTML parsers. htmlparser2 treats a literal solidus (/) immediately after a raw-text end-tag name as text, so the ontext handler emits the following bytes verbatim without HTML-encoding. Browsers, following the HTML5 tokenizer specification, treat the same sequence as a valid end tag and return to the normal parsing state. Any HTML following the malformed end tag, such as <img src=x onerror=...>, is then parsed as active markup.
Attack Vector
An attacker submits crafted HTML through any content field that passes through sanitizeHtml() with textarea or xmp in the allow-list. The payload embeds a malformed raw-text end tag followed by an img element with an onerror handler. After sanitization, the payload survives intact. When a victim renders the affected page, the browser executes the injected script in the site's origin. Exploitation requires user interaction to load the affected page but no privileges to submit content if guest submission is enabled.
See the GitHub Security Advisory GHSA-jxwj-j7wr-gfrw for technical details on the payload structure.
Detection Methods for CVE-2026-63670
Indicators of Compromise
- Stored content containing </textarea/ or </xmp/ sequences followed by additional HTML tags.
- Presence of onerror, onload, or onfocus attributes in database records that passed through the sanitizer.
- Unexpected outbound requests from user browsers after loading CMS-rendered pages.
Detection Strategies
- Review the sanitizer configuration for any inclusion of textarea or xmp in allowedTags.
- Scan the content database for stored HTML containing malformed end tags with trailing solidus characters.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution in production traffic.
Monitoring Recommendations
- Alert on ApostropheCMS content submissions that contain <img combined with event-handler attributes.
- Track version metadata across ApostropheCMS deployments and flag hosts running versions below 2.17.6.
- Correlate authentication anomalies and cookie theft indicators with page views of user-generated content.
How to Mitigate CVE-2026-63670
Immediate Actions Required
- Upgrade ApostropheCMS to version 2.17.6 or later across all environments.
- Audit stored content for previously injected payloads and purge or re-sanitize affected records.
- Rotate session cookies and administrative credentials if evidence of exploitation is found.
Patch Information
ApostropheCMS resolved the issue in version 2.17.6. The fix is available in the maintainers' upstream repository. Review the ApostropheCMS pull request #5501 and commit eae1fb2 for the sanitizer changes that close the parser-differential.
Workarounds
- Remove textarea and xmp from the allowedTags list passed to sanitizeHtml() until the upgrade is applied.
- Enforce a strict Content Security Policy that blocks inline event handlers and unauthorized script sources.
- Restrict content submission privileges to trusted, authenticated users pending remediation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
