Description
A mutation-XSS / allowedTags bypass: when textarea (or xmp) is included in allowedTags, an input containing a literal </textarea/> (a solidus right after the RCDATA end-tag name) lets non-allowed markup such as <img src=x onerror=…> pass through sanitizeHtml() live and unescaped, even though img/onerror are not in the allowlist.
Recommendation
Update the sanitize-html package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.17.5
- Patched version(s): 2.17.6
References
Could your website be exposed too?
SmartScanner can check your website for ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close and gives you actionable findings to investigate.
Start a free scanRelated Issues
- ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass - CVE-2026-84371
- sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements - CVE-2026-40186
- ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) - CVE-2026-113657
- Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier - CVE-2026-58263
You might also like:
See something that needs correcting? Let us knowUpdated September 03, 2026