CVE-2026-40186— ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
Quick assessment
Affected
apostrophecms apostrophe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ApostropheCMS是Apostrophe Technologies开源的一个全栈内容管理系统。 ApostropheCMS 4.28.0版本存在安全漏洞，该漏洞源于sanitize-html包存在绕过allowedTags强制执行的问题，可能导致跨站脚本攻击。
Possible ATT&CK Techniques 2 AI
T1189 · Drive-by Compromise T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-40186
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
Source: CVE Program / CVE List V5
Vulnerability Description
ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of the ApostropheCMS-maintained sanitize-html package bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). ApostropheCMS version 4.28.0 is affected through its dependency on the vulnerable sanitize-html version. The code at packages/sanitize-html/index.js:569-573 incorrectly assumes that htmlparser2 does not decode entities inside these elements and skips escaping, but htmlparser2 10.x does decode entities before passing text to the ontext callback. As a result, entity-encoded HTML is decoded by the parser and then written directly to the output as literal HTML characters, completely bypassing the allowedTags filter. An attacker can inject arbitrary tags including XSS payloads through any allowed option or textarea element using entity encoding. This affects non-default configurations where option or textarea are included in allowedTags, which is common in form builders and CMS platforms. This issue has been fixed in version 2.17.2 of sanitize-html and 4.29.0 of ApostropheCMS.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
ApostropheCMS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ApostropheCMS是Apostrophe Technologies开源的一个全栈内容管理系统。 ApostropheCMS 4.28.0版本存在安全漏洞，该漏洞源于sanitize-html包存在绕过allowedTags强制执行的问题，可能导致跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| apostrophecms | apostrophe | >= 4.28.0, < 4.29.0 | - |
|
| apostrophecms | sanitize-html | >= 2.17.1, < 2.17.2 | - |
|
II. Public POCs for CVE-2026-40186
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40186
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-40186 (1)
Vendor Advisories for CVE-2026-40186 (1)
Same Patch Batch · apostrophecms · 2026-04-15 · 6 CVEs total
| CVE-2026-35569 | 8.7 HIGH | ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in Apostr |
| CVE-2026-33889 | 5.4 MEDIUM | ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field |
| CVE-2026-39857 | 5.3 MEDIUM | Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjecti |
| CVE-2026-33888 | 5.3 MEDIUM | ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST A |
| CVE-2026-33877 | 3.7 LOW | ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint |
IV. Related Vulnerabilities
Same product: apostrophe
-
CVE-2026-84371
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-polic -
CVE-2026-71553
ApostropheCMS: 2nd-order prototype pollution via PATCH leadi -
CVE-2026-63667
ApostropheCMS: Arbitrary file read via import-export attachm -
CVE-2026-63670
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal -
CVE-2026-63669
ApostropheCMS: Missing destination-parent authorization in p
Same vendor: apostrophecms
-
CVE-2026-84371
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-polic -
CVE-2026-71553
ApostropheCMS: 2nd-order prototype pollution via PATCH leadi -
CVE-2026-63667
ApostropheCMS: Arbitrary file read via import-export attachm -
CVE-2026-63670
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal -
CVE-2026-63669
ApostropheCMS: Missing destination-parent authorization in p
Same weakness: CWE-79
-
CVE-2026-105291
feelec-yishu feelcrm-os Department Search Endpoint GroupCont -
CVE-2026-59788
Stored XSS vulnerability in OAuth configuration form -
CVE-2026-105289
feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFo -
CVE-2026-105288
feelec-yishu feelcrm-os Crm Endpoint functions.php index cro -
CVE-2026-102393
WordPress Starter Templates plugin <= 4.7.7 - Cross Site Scr
V. Comments for CVE-2026-40186
No comments yet