CVE-2026-63670 is a cross-site scripting vulnerability in ApostropheCMS, an open-source Node.js content management system. The vulnerability arises because the sanitizeHtml() function in versions before 2.17.6 can pass disallowed executable markup when textarea or xmp tags are included in allowedTags. This occurs because a literal solidus after the raw-text end-tag name is treated as text by the htmlparser2 library, causing the ontext handler to emit unescaped content. Browsers then parse subsequent injected markup, such as img onerror, as active HTML, enabling XSS attacks. The vulnerability is fixed in ApostropheCMS version 2.17.6.

Successful exploitation could allow an attacker to inject and execute arbitrary HTML or JavaScript in the context of the affected web application, potentially leading to information disclosure or user session compromise. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

Upgrade ApostropheCMS to version 2.17.6 or later, where this vulnerability is fixed. Patch status is confirmed by the vendor advisory indicating the fix in 2.17.6. No other mitigation is specified or required.