CVE-2026-40186
Description
A flaw was found in the sanitize-html package, a dependency of ApostropheCMS. A remote attacker could exploit a regression in sanitize-html versions prior to 2.17.2, which incorrectly handles entity decoding within textarea and option HTML elements. This allows an attacker to bypass the allowedTags filter by using entity encoding, leading to the injection of arbitrary HTML tags, including Cross-Site Scripting (XSS) payloads. Successful exploitation could result in arbitrary code execution in the context of the user's browser.
Statement
This Moderate flaw in the sanitize-html package, a dependency for several Red Hat products, enables Cross-Site Scripting (XSS) attacks. The vulnerability occurs when entity-encoded HTML within textarea or option elements bypasses the allowedTags filter. Exploitation is limited to non-default configurations where these elements are explicitly permitted in allowedTags, reducing the immediate risk to typical Red Hat deployments.
Mitigation
To mitigate this issue, ensure that `textarea` and `option` elements are not explicitly included in the `allowedTags` configuration of the `sanitize-html` package. If these elements are essential, implement robust input validation at the application layer to prevent the injection of entity-encoded HTML. Review and harden content sanitization policies to prevent Cross-Site Scripting.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | N/A | 6.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Application Data; Execute Unauthorized Code or Commands
An attacker could modify the structure of the message or data being sent to the downstream component, possibly injecting commands.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
