THREAT OPS › Threat News › [GHSA] GHSA-jxwj-j7wr-gfrw (medium) — ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
[GHSA] GHSA-jxwj-j7wr-gfrw (medium) — ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
GHSA-jxwj-j7wr-gfrw Severity: medium CVE: CVE-2026-63670
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
### Summary A mutation-XSS / allowedTags bypass: when `textarea` (or `xmp`) is included in `allowedTags`, an input containing a literal `</textarea/>` (a solidus right after the RCDATA end-tag name) lets non-allowed markup such as `<img src=x onerror=
Indicators of compromise
- CVE-2026-63670cve
- CVE-2026-40186cve
- CVE-2026-44990cve
Original source: https://github.com/advisories/GHSA-jxwj-j7wr-gfrw