CVE-2026-44990
1 advisory.
npm/sanitize-html CVE-2026-44990: critical 9.3, EPSS 0.68%
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
Action: Upgrade sanitize-html to 2.17.4 or later.
npm i sanitize-html@2.17.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.17.3 | 2.17.4 | - |
Fixed versions
| 2.17.4 |
Sources
- osv: GHSA-rpr9-rxv7-x643
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643
- https://nvd.nist.gov/vuln/detail/CVE-2026-44990
- https://github.com/apostrophecms/apostrophe/issues/5418
- https://github.com/apostrophecms/apostrophe/commit/8d4c882b4ed3a7ce802cd87f89f0c1cb7482b8c2
- https://github.com/apostrophecms/apostrophe
CVE-2026-44990 · published · modified · JSON