THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-44990 (CRITICAL 9.3) — ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` elem

[NVD] CVE-2026-44990 (CRITICAL 9.3) — ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` elem

lownvdPublished 2026-06-12

CVE-2026-44990 CVSS: 9.3 CRITICAL Published: 2026-06-12T21:16:22.447

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a saniti

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-44990cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-44990