The sanitize-html library used by ApostropheCMS has a sanitizer bypass vulnerability (CWE-79) in versions before 2.17.4. Under the default configuration with disallowedTagsMode set to 'discard', malicious content embedded within a disallowed xmp element can be rendered as executable HTML or JavaScript. This results in stored cross-site scripting that can execute arbitrary code or disclose information when the sanitized output is rendered to users. Red Hat products using this library are affected. The vulnerability is addressed in sanitize-html version 2.17.4.

Successful exploitation allows attackers to execute arbitrary code or disclose sensitive information via stored XSS when users view the malicious content. This can compromise user confidentiality and integrity, potentially leading to account compromise or unauthorized actions performed in the context of the affected application. The vulnerability has a CVSS v3.1 score of 9.3 (critical), indicating high impact with network attack vector, low complexity, no privileges required, and user interaction required.

A fix is available in sanitize-html version 2.17.4. Users and vendors should upgrade to version 2.17.4 or later to remediate this vulnerability. Red Hat advisories indicate that no alternative mitigations meet their criteria, so applying the official patch is the recommended action.