CVE-2026-63670 in Apostrophe
Summary
by MITRE • 08/17/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
ApostropheCMS, an open-source content management system built on Node.js, contains a critical cross-site scripting vulnerability that arises from improper sanitization of user-supplied input prior to rendering. The flaw resides within the sanitizeHtml function located in packages/sanitize-html/index.js, which is responsible for stripping dangerous markup from HTML strings before they are processed by the browser. In versions prior to 2.17.6, this sanitizer fails to adequately neutralize executable scripts when specific raw-text elements such as textarea or xmp are included in the list of allowed tags. This oversight creates a pathway for attackers to inject malicious JavaScript code that bypasses standard security controls and executes within the context of the victim's browser session.
The technical root cause of this vulnerability is rooted in the divergent parsing behaviors between the htmlparser2 library used by ApostropheCMS and modern web browsers. When an allowed raw-text tag like textarea or xmp is encountered, the sanitizer relies on htmlparser2 to process the content inside these tags. According to the HTML5 specification, a literal solidus character immediately following the end-tag name of a raw-text element is treated as plain text rather than part of the closing tag syntax by htmlparser2. Consequently, the library's ontext handler emits this content without applying necessary escaping mechanisms. However, web browsers adhere strictly to the HTML5 parsing algorithm for raw-text elements, where such constructs are interpreted differently during rendering. This discrepancy allows an attacker to craft a payload that appears as benign text to the server-side sanitizer but is recognized by the browser as active executable markup, specifically leveraging event handlers like onerror within img tags embedded in the malicious string.
The operational impact of this vulnerability is significant, particularly for applications relying on ApostropheCMS to manage user-generated content or rich text fields. An authenticated attacker with permission to create or edit pages containing these specific HTML structures can execute arbitrary JavaScript code in the context of other users' browsers. This capability enables a range of malicious activities including session hijacking through theft of authentication cookies, credential harvesting via keylogging scripts, defacement of website content, and potentially pivoting to further attacks against backend infrastructure if client-side security boundaries are insufficient. The vulnerability effectively undermines the integrity of the content management system by allowing stored cross-site scripting that persists until the affected page is updated or removed.
To mitigate this risk, organizations using ApostropheCMS must immediately upgrade to version 2.17.6 or later where the sanitization logic has been corrected to align with browser parsing behavior for raw-text elements. For environments unable to patch instantly due to dependency constraints, administrators should implement strict input validation that rejects any HTML containing textarea or xmp tags when combined with potential script injection patterns such as img onerror attributes. Additionally, deploying a Web Application Firewall configured to detect and block cross-site scripting payloads involving these specific tag combinations can provide an additional layer of defense. It is also advisable to enforce Content Security Policy headers that restrict the execution of inline scripts and limit sources for external resources, thereby reducing the blast radius should such vulnerabilities be exploited in other components or future releases.
This vulnerability aligns with Common Weakness Enumeration CWE-79 which classifies improper neutralization of input during web page generation as a cross-site scripting flaw. From an offensive security perspective, this attack vector corresponds to ATT&CK technique T1059.007 representing JavaScript execution within the browser environment. The specific mechanism involving raw-text element parsing discrepancies highlights the importance of ensuring that server-side sanitizers do not rely on libraries with divergent standards compliance compared to target browsers. Security teams should prioritize regular updates to CMS platforms and conduct thorough code reviews focusing on HTML sanitization logic, particularly when allowing complex or nested HTML structures in user inputs.