This vulnerability involves a mutation-XSS or allowedTags bypass in sanitize-html used by apostrophecms apostrophe. When 'textarea' or 'xmp' tags are allowed, an input containing a literal '</textarea/>' (a solidus after the RCDATA end-tag name) is mis-tokenized by htmlparser2, causing the sanitizer to emit raw, unescaped content. This allows non-allowed markup like <img src=x onerror=...> to pass through live and unescaped, resulting in XSS. The issue bypasses previous fixes (CVE-2026-40186 and CVE-2026-44990) which addressed entity-encoding and default xmp handling but not this literal-solidus mis-tokenization. The default sanitize-html configuration without 'textarea' allowed is safe. The vulnerability affects versions before 2.17.6.

An attacker who can submit content that is sanitized with a configuration allowing 'textarea' or 'xmp' tags can inject malicious scripts via non-allowed tags such as <img> with event handlers. This leads to stored or reflected cross-site scripting, potentially enabling cookie theft or session hijacking. The default configuration is not vulnerable, so exploitation requires specific user configuration. The CVSS 3.1 score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and partial confidentiality and integrity impact.

A fix is available in apostrophecms apostrophe version 2.17.6 and later. Users should upgrade to version 2.17.6 or above to remediate this vulnerability. The suggested fix involves routing 'textarea' and 'xmp' content through HTML escaping instead of raw passthrough, and/or correcting the htmlparser2 tokenization to conform to the WHATWG specification. Until upgrading, avoid allowing 'textarea' or 'xmp' tags in sanitize-html configurations to prevent exposure.