CVE-2026-44990: Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

May 14, 2026 (updated June 12, 2026)

Under the default configuration, sanitize-html can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in the default disallowedTagsMode: 'discard' path and can lead to stored XSS in applications that render sanitized output back to users.

References

github.com/advisories/GHSA-rpr9-rxv7-x643
github.com/apostrophecms/apostrophe/commit/8d4c882b4ed3a7ce802cd87f89f0c1cb7482b8c2
github.com/apostrophecms/apostrophe/issues/5418
github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643
nvd.nist.gov/vuln/detail/CVE-2026-44990

Code Behaviors & Features

Detect and mitigate CVE-2026-44990 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →