https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 05:35:47 +0000 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1256 certfr-2026-avi-1256 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1256 https://vulnerability.circl.lu/vuln/fkie_cve-2026-63670 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-63670 https://vulnerability.circl.lu/vuln/ghsa-jxwj-j7wr-gfrw <p><strong>Affected:</strong> npm: sanitize-html</p> <p>### Summary A mutation-XSS / allowedTags bypass: when `textarea` (or `xmp`) is included in `allowedTags`, an input containing a literal `&lt;/textarea/&gt;` (a solidus right after the RCDATA end-tag name) lets non-allowed markup such as `&lt;img src=x onerror=…&gt;` pass through `sanitizeHtml()` **live and unescaped**, even though `img`/`onerror` are not in the allowlist. A spec-compliant browser executes the surviving handler — XSS. This is a literal-solidus variant that bypasses the two most recent fixes in this code area (CVE-2026-40186, CVE-2026-44990), both already applied in 2.17.5. The default configuration is not affected.</p> <p>### Details `sanitize-html` emits the text content of HTML raw-text elements (`textarea`, `xmp`) without escaping. Two things combine: - **Parser differential:** on input, htmlparser2 does NOT recognize `&lt;/textarea/&gt;` (solidus after the RCDATA end-tag name) as a close tag; it emits `&lt;/textarea/&gt;&lt;img …&gt;` as a single raw-text node. - **Unescaped passthrough:** the `ontext` handler (`index.js` ~575-583) appends `textarea`/`xmp` content with `result += text` (no `escapeHtml`), assuming it is &#34;already properly encoded&#34; — true for entity-decoded content (what CVE-2026-40186 fixed) but false for this mis-tokenized literal close tag. A spec browser treats `&lt;/textarea/&gt;` as a valid `textarea` close, so the following `&lt;img onerror&gt;` is parsed as a live element. The recent fixes addressed entity-encoding (CVE-2026-40186) and the `xmp` default (CVE-2026-44990); neith…</p> <p><strong>Affected:</strong> npm: sanitize-html</p> <p>### Summary A mutation-XSS / allowedTags bypass: when `textarea` (or `xmp`) is included in `allowedTags`, an input containing a literal `&lt;/textarea/&gt;` (a solidus right after the RCDATA end-tag name) lets non-allowed markup such as `&lt;img src=x onerror=…&gt;` pass through `sanitizeHtml()` **live and unescaped**, even though `img`/`onerror` are not in the allowlist. A spec-compliant browser executes the surviving handler — XSS. This is a literal-solidus variant that bypasses the two most recent fixes in this code area (CVE-2026-40186, CVE-2026-44990), both already applied in 2.17.5. The default configuration is not affected.</p> <p>### Details `sanitize-html` emits the text content of HTML raw-text elements (`textarea`, `xmp`) without escaping. Two things combine: - **Parser differential:** on input, htmlparser2 does NOT recognize `&lt;/textarea/&gt;` (solidus after the RCDATA end-tag name) as a close tag; it emits `&lt;/textarea/&gt;&lt;img …&gt;` as a single raw-text node. - **Unescaped passthrough:** the `ontext` handler (`index.js` ~575-583) appends `textarea`/`xmp` content with `result += text` (no `escapeHtml`), assuming it is &#34;already properly encoded&#34; — true for entity-decoded content (what CVE-2026-40186 fixed) but false for this mis-tokenized literal close tag. A spec browser treats `&lt;/textarea/&gt;` as a valid `textarea` close, so the following `&lt;img onerror&gt;` is parsed as a live element. The recent fixes addressed entity-encoding (CVE-2026-40186) and the `xmp` default (CVE-2026-44990); neith…</p> https://vulnerability.circl.lu/vuln/ghsa-jxwj-j7wr-gfrw