A regression introduced in a specific commit of the sanitize‑html package causes the library to incorrectly skip escaping of text inside certain non‑text tags such as textarea and option. The parser decodes entity‑encoded characters before passing them to the callback, which results in entity‑decoded HTML being written directly to the output, bypassing the allowedTags filter. An attacker who can supply encoded input to these elements is able to inject arbitrary tags—including XSS payloads—into the rendered page. The vulnerability affects any configuration that permits textarea or option in its allowlist, a scenario common in form builders and content management platforms.

ApostropheCMS version 4.28.0 is impacted because it depends on the vulnerable sanitize‑html 2.17.1. The sanitize‑html package itself is affected when used in versions 2.17.1 and earlier. The issue is resolved starting with sanitize‑html 2.17.2 and ApostropheCMS 4.29.0.

The CVSS base score for this issue is 6.1, indicating a moderate level of risk. EPSS data is not currently available, and the vulnerability has not been listed in the CISA KEV catalog. Attackers could exploit the flaw by submitting specially crafted, entity‑encoded content through any form element that includes textarea or option in its allowedTags list, causing the escaped input to be rendered as literal markup in users’ browsers. Properly configured controls can reduce the risk, but the presence of the allowedTags loophole creates a straightforward path for client‑side code injection.