PT-2026-41152 · Npm · Sanitize-Html

Published 2026-05-14 · Updated 2026-06-14 · CVE-2026-44990

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions sanitize-html version 2.17.3

Description A sanitizer bypass exists in the default configuration where the disallowedTagsMode: 'discard' path fails to properly handle the xmp element. Because xmp is not included in the nonTextTags list, its contents are not discarded. Instead, the ontext handler appends the text content of xmp tags directly to the output without escaping. Since htmlparser2 treats xmp as a raw-text element, any markup inside it is parsed as text but becomes live HTML or JavaScript once appended to the sanitized output. This allows a remote attacker to smuggle payloads, such as <script> tags or event handlers, leading to stored cross-site scripting (XSS) when the output is rendered in a browser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-44990

GHSA-RPR9-RXV7-X643

Affected Products

Sanitize-Html

References · 11

• 🔥 https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643 · Exploit
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44990 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rpr9-rxv7-x643 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44990 · Security Note
• https://github.com/apostrophecms/apostrophe/commit/8d4c882b4ed3a7ce802cd87f89f0c1cb7482b8c2 · Note
• https://github.com/apostrophecms/apostrophe/issues/5418 · Note
• https://github.com/apostrophecms/apostrophe · Note
• https://t.me/CVEtracker/56736 · Telegram Post
• https://twitter.com/antony_oti/status/2056857516365984016 · Twitter Post
• https://t.me/cveNotify/167317 · Telegram Post
• https://twitter.com/CVEnew/status/2066216172022792397 · Twitter Post