CVE-2026-44990

Fixed in a distro release EPSS <1%CVSS 9.3

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Published 2026-06-12 · CVE record · OSV

Products: apostrophecms sanitize-html, Red Hat multicluster engine for Kubernetes 2.1, Red Hat multicluster engine for Kubernetes 2.11, Red Hat multicluster engine for Kubernetes 2.17, Red Hat multicluster engine for Kubernetes 2.6, Red Hat multicluster engine for Kubernetes 2.8, Red Hat multicluster engine for Kubernetes 2.9, Red Hat Advanced Cluster Management for Kubernetes 2.11, Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat Advanced Cluster Management for Kubernetes 2.14, Red Hat Advanced Cluster Management for Kubernetes 2.15, Red Hat Advanced Cluster Management for Kubernetes 2.16, Red Hat Advanced Cluster Management for Kubernetes 2.17, Red Hat Container Native Virtualization 4.19, Red Hat Container Native Virtualization 4.20, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift Container Platform 4.21, Red Hat OpenShift Container Platform 4.22, Red Hat OpenShift Dev Spaces 3.29, Red Hat Quay 3.10, Red Hat Quay 3.12, Red Hat Quay 3.15, Red Hat Quay 3.16, Red Hat Quay 3.9, Red Hat Satellite 6.18, Red Hat Satellite 6.19, Red Hat Hardened Images, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Satellite 6

Fixed upstream

Distro releases