IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
9.3Kritik

CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

apostrophecms sanitize-html; Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for K… Yayım: (5 ay önce)

Açıklama

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Zayıflık türü (CWE): CWE-79

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
acm 2.11 —
acm 2.13 —
acm 2.14 —
acm 2.15 —
acm 2.16 —
acm 2.17 —
apostrophecms sanitize-html < 2.17.4
container native virtualization 4.19 —
container native virtualization 4.20 —
multicluster engine 2.10 —
multicluster engine 2.11 —
multicluster engine 2.17 —
multicluster engine 2.6 —
multicluster engine 2.8 —
multicluster engine 2.9 —
openshift 4.20 —
openshift 4.21 —
openshift 4.22 —
openshift devspaces 3.29 —
quay 3.10 —
quay 3.12 —
quay 3.15 —
quay 3.16 —
quay 3.9 —
Red Hat multicluster engine for Kubernetes 2.1 all versions
Red Hat multicluster engine for Kubernetes 2.11 all versions
Red Hat multicluster engine for Kubernetes 2.17 all versions
Red Hat multicluster engine for Kubernetes 2.6 all versions
Red Hat multicluster engine for Kubernetes 2.8 all versions
Red Hat multicluster engine for Kubernetes 2.9 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 all versions
Red Hat Red Hat Container Native Virtualization 4.19 all versions
Red Hat Red Hat Container Native Virtualization 4.20 all versions
Red Hat Red Hat Hardened Images —
Red Hat Red Hat OpenShift AI (RHOAI) all versions
Red Hat Red Hat OpenShift Container Platform 4 all versions
Red Hat Red Hat OpenShift Container Platform 4.20 all versions
Red Hat Red Hat OpenShift Container Platform 4.21 all versions
Red Hat Red Hat OpenShift Container Platform 4.22 all versions
Red Hat Red Hat OpenShift Dev Spaces 3.29 all versions
Red Hat Red Hat Quay 3.10 all versions
Red Hat Red Hat Quay 3.12 all versions
Red Hat Red Hat Quay 3.15 all versions
Red Hat Red Hat Quay 3.16 all versions
Red Hat Red Hat Quay 3.9 all versions
Red Hat Red Hat Satellite 6 all versions
Red Hat Red Hat Satellite 6.18 all versions
Red Hat Red Hat Satellite 6.19 all versions
satellite 6.18 —
satellite 6.19 —

Kaynaklar ve yamalar