Описание
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of sanitize-html prior to 2.17.4 can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
A flaw was found in the sanitize-html library. Under its default configuration, an attacker can embed malicious content within a disallowed xmp element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.
Отчет
This is an Important flaw. The sanitize-html library, used in Red Hat products, is susceptible to a stored Cross-Site Scripting (XSS) bypass. Malicious content within a disallowed xmp element can be rendered as live HTML or JavaScript due to a sanitizer bypass in the default configuration. This can lead to arbitrary code execution or information disclosure when affected content is viewed.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | opentelemetry-collector | Not affected | ||
| Red Hat Hardened Images | opentelemetry-collector-contrib | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mlflow-rhel9 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-agent-installer-ui-rhel9 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console-rhel9 | Affected | ||
| Red Hat Satellite 6 | nodejs-sanitize-html | Not affected | ||
| Red Hat Satellite 6 | satellite/iop-advisor-frontend-rhel9 | Affected | ||
| multicluster engine for Kubernetes 2.1 | multicluster-engine/console-mce-rhel9 | Fixed | RHSA-2026:46885 | 27.07.2026 |
| multicluster engine for Kubernetes 2.1 | multicluster-engine/console-mce-rhel9 | Fixed | RHSA-2026:47388 | 28.07.2026 |
Показывать по
Дополнительная информация
Статус:
8.1 High
CVSS3
Связанные уязвимости
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
8.1 High
CVSS3