CVE-2026-40186 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS deployments, particularly those using form builders or CMS platforms with non-default allowedTags configurations, should assess exposure and prioritize remediation.

Why it matters

Defenders should care about CVE-2026-40186 because it allows for potential XSS payload injection in ApostropheCMS deployments using vulnerable versions of the sanitize-html package. The vulnerability can be exploited through entity encoding in option or textarea elements, bypassing the allowedTags filter. Defenders responsible for ApostropheCMS deployments, particularly those with non-default form builders or CMS platforms, should assess exposure and prioritize remediation. The operational impacts include potential for XSS payload injection, bypass of allowedTags filter, risk of arbitrary tag injection, and need for verification of affected versions and remediation status.

• Potential for XSS payload injection through entity encoding in option or textarea elements
• Bypass of allowedTags filter in sanitize-html package
• Risk of arbitrary tag injection in non-default configurations
• Need for verification of affected versions and remediation status

Technical summary

The sanitize-html package in ApostropheCMS versions 4.28.0 and prior contains a regression that allows for arbitrary tag injection, including XSS payloads, through entity encoding in option or textarea elements. This is due to incorrect assumptions about htmlparser2 decoding entities inside non-text tags. The regression was introduced in commit 49d0bb7 and fixed in version 2.17.2 of sanitize-html and 4.29.0 of ApostropheCMS. Defenders should prioritize upgrading to ApostropheCMS version 4.29.0 or later and ensuring that the sanitize-html package is updated to version 2.17.2 or later.

Defensive priority

Defenders should prioritize upgrading to ApostropheCMS version 4.29.0 or later and ensuring that the sanitize-html package is updated to version 2.17.2 or later.

Recommended defensive actions

• Upgrade to ApostropheCMS version 4.29.0 or later
• Update the sanitize-html package to version 2.17.2 or later
• Review and restrict allowedTags configurations in non-default form builders and CMS platforms
• Monitor for suspicious activity in option and textarea elements
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by a regression introduced in commit 49d0bb7 of the sanitize-html package. The issue has been fixed in version 2.17.2 of sanitize-html and 4.29.0 of ApostropheCMS. Defenders should verify affected versions and remediation status. The regression allows for arbitrary tag injection through entity encoding in option or textarea elements, bypassing the allowedTags filter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.