The sanitize-html library used by ApostropheCMS has a sanitizer bypass vulnerability in versions before 2.17.4. Under the default configuration (disallowedTagsMode: 'discard'), malicious content embedded inside a disallowed xmp element can be transformed into executable HTML or JavaScript, resulting in stored XSS. This vulnerability allows attackers to inject scripts that execute in the context of users viewing the sanitized content, potentially leading to arbitrary code execution or data leakage. The issue is tracked as CVE-2026-44990 with a CVSS 3.1 score of 9.3 (critical). Red Hat advisories confirm the vulnerability and note that version 2.17.4 patches the flaw. No mitigation other than upgrading is currently recommended by Red Hat.

This vulnerability enables attackers to bypass HTML sanitization and inject stored cross-site scripting payloads. When users view the affected sanitized content, the malicious scripts can execute, potentially leading to arbitrary code execution or unauthorized disclosure of sensitive information. The impact includes compromise of confidentiality and integrity of user data and possible session hijacking or other malicious actions performed in the context of the victim's browser.

A patch is available in sanitize-html version 2.17.4. Users and administrators should upgrade to version 2.17.4 or later to remediate this vulnerability. Red Hat advisories indicate no effective mitigation other than applying the official fix. No temporary workaround meeting Red Hat's criteria is currently available.