sanitize-html, the popular HTML sanitizer used by ApostropheCMS, has a configuration flaw that allows attacker‑controlled text inside an 'xmp' element to bypass the default sanitization path. With the disallowedTagsMode set to 'discard', the sanitizer incorrectly treats the raw content of the xmp element as executable HTML or JavaScript, enabling stored XSS. This flaw is classified as CWE‑79 and can cause client‑side code execution, credential theft, session hijacking, and other malicious actions when users view the affected pages.

The vulnerability affects all releases of sanitize‑html older than 2.17.4 that rely on the default configuration. Applications built on ApostropheCMS that include these earlier versions are at risk until a patched version is deployed.

The CVSS score of 9.3 marks this bug as critical, though the EPSS score of less than 1% suggests that widespread exploitation is currently unlikely. The flaw is not listed in CISA’s KEV catalog, but it can be exploited via stored XSS in any content that traverses the sanitizer with default settings. Attackers would need to inject malicious payloads into input fields that are subsequently sanitized and displayed back to users, taking advantage of the xmp passthrough.