{"action":"Upgrade sanitize-html to 2.17.3 or later.","affected":[{"fixed":"2.17.3","introduced":"2.17.2"}],"component":"sanitize-html","cve_ids":["CVE-2026-40186"],"ecosystem":"npm","epss":0.00248,"exploited":false,"fixed_versions":["2.17.3"],"ghsa_id":"GHSA-9mrh-v2v3-xpfm","id":"tcs_01M5KFGBQYH85CKC1CBBM1ARWK","modified_at":"2026-04-16T21:26:28.221563Z","published_at":"2026-04-16T21:08:29Z","references":["https://osv.dev/vulnerability/GHSA-9mrh-v2v3-xpfm","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9mrh-v2v3-xpfm","https://nvd.nist.gov/vuln/detail/CVE-2026-40186","https://github.com/apostrophecms/apostrophe/commit/7ca2d16237c72718ef7e5c7ae0458e6027ac4f64","https://github.com/apostrophecms/apostrophe"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-9mrh-v2v3-xpfm","url":"https://osv.dev/vulnerability/GHSA-9mrh-v2v3-xpfm"}],"summary":"sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements"}