{"action":"Upgrade sanitize-html to 2.17.6 or later.","affected":[{"fixed":"2.17.6","introduced":"0"}],"component":"sanitize-html","cve_ids":["CVE-2026-63670"],"ecosystem":"npm","epss":0.00327,"exploited":false,"fixed_versions":["2.17.6"],"ghsa_id":"GHSA-jxwj-j7wr-gfrw","id":"tcs_01M5KFZ8DRN1FB20SBHPXYE104","modified_at":"2026-09-03T20:15:05.883593916Z","published_at":"2026-09-03T20:07:16Z","references":["https://osv.dev/vulnerability/GHSA-jxwj-j7wr-gfrw","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw","https://nvd.nist.gov/vuln/detail/CVE-2026-63670","https://github.com/apostrophecms/apostrophe/pull/5501","https://github.com/apostrophecms/apostrophe/commit/eae1fb2b72ec5d1c27d0977509c6482a0408f725","https://github.com/apostrophecms/apostrophe"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-jxwj-j7wr-gfrw","url":"https://osv.dev/vulnerability/GHSA-jxwj-j7wr-gfrw"}],"summary":"ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close"}