9.3 Critical

CVE-2026-44990 ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer…

Description

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Affected products and versions

Product	Affected versions	Fixed in
sanitize-html 2.17	earliest → < 2.17.4	2.17.4
Multicluster Engine for Kubernetes	Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2	Versions not published
Red Hat Hardened Images	Versions not published
Red Hat OpenShift AI (RHOAI)	Versions not published
Red Hat OpenShift Container Platform 4	Versions not published
Red Hat OpenShift Dev Spaces	Versions not published
Red Hat OpenShift Virtualization 4	Versions not published
Red Hat Quay 3	Versions not published

Show the 31 other branches

Product	Affected versions	Fixed in
Red Hat Satellite 6	Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2.14 1783451729	earliest → < 1783451729	1783451729
multicluster engine for Kubernetes 2.9 1783348181	earliest → < 1783348181	1783348181
multicluster engine for Kubernetes 2.6 1783351002	earliest → < 1783351002	1783351002
Red Hat Quay 3.9 1784125838	earliest → < 1784125838	1784125838
Red Hat Advanced Cluster Management for Kubernetes 2.11 1783350952	earliest → < 1783350952	1783350952
Red Hat Quay 3.10 1783750447	earliest → < 1783750447	1783750447
Red Hat Quay 3.16 1783955846	earliest → < 1783955846	1783955846
Red Hat Quay 3.1 1783750447	earliest → < 1783750447	1783750447
Red Hat Quay 3.12 1784353904	earliest → < 1784353904	1784353904
Red Hat Quay 3.12 1783751865	earliest → < 1783751865	1783751865
Red Hat Quay 3.15 1784351966	earliest → < 1784351966	1784351966
multicluster engine for Kubernetes 2.10 1784312384	earliest → < 1784312384	1784312384
multicluster engine for Kubernetes 2.9.0 1783348181	earliest → < 1783348181	1783348181
Red Hat Advanced Cluster Management for Kubernetes 2.15 1784578812	earliest → < 1784578812	1784578812
Red Hat Container Native Virtualization 4.19 1784844382	earliest → < 1784844382	1784844382
Red Hat Container Native Virtualization 4.20 1784629964	earliest → < 1784629964	1784629964
multicluster engine for Kubernetes 2.8 1785078604	earliest → < 1785078604	1785078604
Red Hat Advanced Cluster Management for Kubernetes 2.13 1785078581	earliest → < 1785078581	1785078581
Red Hat OpenShift Dev Spaces 3.29 1784737150	earliest → < 1784737150	1784737150
multicluster engine for Kubernetes 2.1 1784312384	earliest → < 1784312384	1784312384
Red Hat Container Native Virtualization 4.2 1784629964	earliest → < 1784629964	1784629964
Red Hat Satellite 6.19 1785937325	earliest → < 1785937325	1785937325
Red Hat Satellite 6.18 1785922764	earliest → < 1785922764	1785922764
multicluster engine for Kubernetes 2.11 1786911977	earliest → < 1786911977	1786911977
multicluster engine for Kubernetes 2.17 1786668856	earliest → < 1786668856	1786668856
Red Hat Advanced Cluster Management for Kubernetes 2.16 1786908361	earliest → < 1786908361	1786908361
Red Hat Advanced Cluster Management for Kubernetes 2.17 1787335105	earliest → < 1787335105	1787335105
Red Hat OpenShift Container Platform 4.22 1787746382	earliest → < 1787746382	1787746382
Red Hat OpenShift Container Platform 4.20 1788350963	earliest → < 1788350963	1788350963
Red Hat OpenShift Container Platform 4.21 1788359934	earliest → < 1788359934	1788359934