CVE-2026-40186

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40186", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-09T20:59:17.620Z", "datePublished": "2026-04-15T20:15:12.333Z", "dateUpdated": "2026-04-16T14:15:41.275Z"}, "containers": {"cna": {"title": "ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9mrh-v2v3-xpfm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9mrh-v2v3-xpfm"}, {"name": "https://github.com/apostrophecms/apostrophe/commit/7ca2d16237c72718ef7e5c7ae0458e6027ac4f64", "tags": ["x_refsource_MISC"], "url": "https://github.com/apostrophecms/apostrophe/commit/7ca2d16237c72718ef7e5c7ae0458e6027ac4f64"}], "affected": [{"vendor": "apostrophecms", "product": "apostrophe", "versions": [{"version": ">= 4.28.0, < 4.29.0", "status": "affected"}]}, {"vendor": "apostrophecms", "product": "sanitize-html", "versions": [{"version": ">= 2.17.1, < 2.17.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-15T20:15:12.333Z"}, "descriptions": [{"lang": "en", "value": "ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of the ApostropheCMS-maintained sanitize-html package bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). ApostropheCMS version 4.28.0 is affected through its dependency on the vulnerable sanitize-html version. The code at packages/sanitize-html/index.js:569-573 incorrectly assumes that htmlparser2 does not decode entities inside these elements and skips escaping, but htmlparser2 10.x does decode entities before passing text to the ontext callback. As a result, entity-encoded HTML is decoded by the parser and then written directly to the output as literal HTML characters, completely bypassing the allowedTags filter. An attacker can inject arbitrary tags including XSS payloads through any allowed option or textarea element using entity encoding. This affects non-default configurations where option or textarea are included in allowedTags, which is common in form builders and CMS platforms. This issue has been fixed in version 2.17.2 of sanitize-html and 4.29.0 of ApostropheCMS."}], "source": {"advisory": "GHSA-9mrh-v2v3-xpfm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T14:15:28.694337Z", "id": "CVE-2026-40186", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T14:15:41.275Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40186", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-09T20:59:17.620Z", "datePublished": "2026-04-15T20:15:12.333Z", "dateUpdated": "2026-04-16T14:15:41.275Z"}, "containers": {"cna": {"title": "ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9mrh-v2v3-xpfm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9mrh-v2v3-xpfm"}, {"name": "https://github.com/apostrophecms/apostrophe/commit/7ca2d16237c72718ef7e5c7ae0458e6027ac4f64", "tags": ["x_refsource_MISC"], "url": "https://github.com/apostrophecms/apostrophe/commit/7ca2d16237c72718ef7e5c7ae0458e6027ac4f64"}], "affected": [{"vendor": "apostrophecms", "product": "apostrophe", "versions": [{"version": ">= 4.28.0, < 4.29.0", "status": "affected"}]}, {"vendor": "apostrophecms", "product": "sanitize-html", "versions": [{"version": ">= 2.17.1, < 2.17.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-15T20:15:12.333Z"}, "descriptions": [{"lang": "en", "value": "ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of the ApostropheCMS-maintained sanitize-html package bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). ApostropheCMS version 4.28.0 is affected through its dependency on the vulnerable sanitize-html version. The code at packages/sanitize-html/index.js:569-573 incorrectly assumes that htmlparser2 does not decode entities inside these elements and skips escaping, but htmlparser2 10.x does decode entities before passing text to the ontext callback. As a result, entity-encoded HTML is decoded by the parser and then written directly to the output as literal HTML characters, completely bypassing the allowedTags filter. An attacker can inject arbitrary tags including XSS payloads through any allowed option or textarea element using entity encoding. This affects non-default configurations where option or textarea are included in allowedTags, which is common in form builders and CMS platforms. This issue has been fixed in version 2.17.2 of sanitize-html and 4.29.0 of ApostropheCMS."}], "source": {"advisory": "GHSA-9mrh-v2v3-xpfm", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40186", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T14:15:28.694337Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T14:15:35.421Z"}}]}}

{"affected": [{"affectedData": [{"product": "apostrophe", "vendor": "apostrophecms", "versions": [{"status": "affected", "version": ">= 4.28.0, < 4.29.0"}]}, {"product": "sanitize-html", "vendor": "apostrophecms", "versions": [{"status": "affected", "version": ">= 2.17.1, < 2.17.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apostrophecms:apostrophecms:4.29.0:*:*:*:*:*:*:*", "matchCriteriaId": "BD79AAB3-1AE2-4E64-92AB-FD59A7D1F5E7", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "807F7A51-2171-47B7-A780-1DA41F5C8B8D", "versionEndIncluding": "2.17.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of the ApostropheCMS-maintained sanitize-html package bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). ApostropheCMS version 4.28.0 is affected through its dependency on the vulnerable sanitize-html version. The code at packages/sanitize-html/index.js:569-573 incorrectly assumes that htmlparser2 does not decode entities inside these elements and skips escaping, but htmlparser2 10.x does decode entities before passing text to the ontext callback. As a result, entity-encoded HTML is decoded by the parser and then written directly to the output as literal HTML characters, completely bypassing the allowedTags filter. An attacker can inject arbitrary tags including XSS payloads through any allowed option or textarea element using entity encoding. This affects non-default configurations where option or textarea are included in allowedTags, which is common in form builders and CMS platforms. This issue has been fixed in version 2.17.2 of sanitize-html and 4.29.0 of ApostropheCMS."}, {"lang": "es", "value": "ApostropheCMS es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto basado en Node.js. Una regresi\u00f3n introducida en el commit 49d0bb7, incluida en las versiones 2.17.1 del paquete sanitize-html mantenido por ApostropheCMS, omite la aplicaci\u00f3n de allowedTags para el texto dentro de los elementos nonTextTagsArray (textarea y option). La versi\u00f3n 4.28.0 de ApostropheCMS se ve afectada a trav\u00e9s de su dependencia de la versi\u00f3n vulnerable de sanitize-html. El c\u00f3digo en packages/sanitize-html/index.js:569-573 asume incorrectamente que htmlparser2 no decodifica entidades dentro de estos elementos y omite el escape, pero htmlparser2 10.x s\u00ed decodifica entidades antes de pasar el texto a la devoluci\u00f3n de llamada ontext. Como resultado, el HTML codificado por entidad es decodificado por el analizador y luego se escribe directamente en la salida como caracteres HTML literales, omitiendo completamente el filtro allowedTags. Un atacante puede inyectar etiquetas arbitrarias, incluyendo cargas \u00fatiles de XSS, a trav\u00e9s de cualquier elemento option o textarea permitido utilizando codificaci\u00f3n de entidades. Esto afecta a configuraciones no predeterminadas donde option o textarea est\u00e1n incluidos en allowedTags, lo cual es com\u00fan en constructores de formularios y plataformas CMS. Este problema ha sido solucionado en la versi\u00f3n 2.17.2 de sanitize-html y 4.29.0 de ApostropheCMS."}], "id": "CVE-2026-40186", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40186", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T14:15:28.694337Z", "version": "2.0.3"}}]}, "published": "2026-04-15T21:17:27.523", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/apostrophecms/apostrophe/commit/7ca2d16237c72718ef7e5c7ae0458e6027ac4f64"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9mrh-v2v3-xpfm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.28.0,4.29.0)"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "apostrophe", "source": "cna", "vendor": "apostrophecms"}, "product": "apostrophecms", "vendor": "apostrophecms"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.17.1,2.17.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "sanitize-html", "source": "cna", "vendor": "apostrophecms"}, "product": "sanitize-html", "vendor": "apostrophecms"}], "analysis": {"en": {"generated_at": "2026-04-16T02:20:05.839639+00:00", "value": {"mitigation_remediation": ["Upgrade ApostropheCMS to version 4.29.0 or later, which includes the fixed sanitize\u2011html dependency", "If using sanitize\u2011html directly, update the package to at least 2.17.2 to obtain the fix", "As a temporary workaround, exclude the \u2018textarea\u2019 and \u2018option\u2019 tags from the allowedTags list in the sanitize\u2011html configuration until a patch is applied"], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting (XSS) via Tag Injection"}, "threat_synthesis": {"affected_systems": "ApostropheCMS version 4.28.0 is impacted because it depends on the vulnerable sanitize\u2011html 2.17.1. The sanitize\u2011html package itself is affected when used in versions 2.17.1 and earlier. The issue is resolved starting with sanitize\u2011html 2.17.2 and ApostropheCMS 4.29.0.", "description_and_impact": "A regression introduced in a specific commit of the sanitize\u2011html package causes the library to incorrectly skip escaping of text inside certain non\u2011text tags such as textarea and option. The parser decodes entity\u2011encoded characters before passing them to the callback, which results in entity\u2011decoded HTML being written directly to the output, bypassing the allowedTags filter. An attacker who can supply encoded input to these elements is able to inject arbitrary tags\u2014including XSS payloads\u2014into the rendered page. The vulnerability affects any configuration that permits textarea or option in its allowlist, a scenario common in form builders and content management platforms.", "risk_and_exploitability": "The CVSS base score for this issue is 6.1, indicating a moderate level of risk. EPSS data is not currently available, and the vulnerability has not been listed in the CISA KEV catalog. Attackers could exploit the flaw by submitting specially crafted, entity\u2011encoded content through any form element that includes textarea or option in its allowedTags list, causing the escaped input to be rendered as literal markup in users\u2019 browsers. Properly configured controls can reduce the risk, but the presence of the allowedTags loophole creates a straightforward path for client\u2011side code injection."}}}}, "created": "2026-04-16T02:30:21.680975+00:00", "updated": "2026-04-16T09:00:05.124837+00:00", "vendors": ["apostrophecms", "apostrophecms$PRODUCT$apostrophecms", "apostrophecms$PRODUCT$sanitize-html"], "weaknesses": ["CWE-79"]}