SanitizeHtml function within ApostropheCMS incorrectly handles a literal solidus following the end tag of textarea or xmp. Instead of treating the solidus as part of the markup, the parser emits it as plain text, allowing a crafted img element with an onerror attribute to be embedded. As a result, attackers can insert executable JavaScript into content that bypasses the input filter, leading to client‑side XSS when the page is rendered in a browser.

The vulnerability affects ApostropheCMS installations using versions prior to 2.17.6. The affected component is the sanitize-html module invoked by the system’s content sanitization logic. All deployments of the open‑source Node.js CMS that rely on the default allowedTags configuration are potentially impacted.

The CVSS score of 6.1 indicates a medium severity issue, and the vulnerability is not listed in CISA’s KEV catalog. EPSS data is unavailable. Attackers who can submit or modify content that includes a literal </textarea/> tag are likely able to exploit the flaw, surfacing XSS in contexts where the CMS renders user input. The attack vector is inferred to be through the CMS administrative interface or API endpoints that accept rich‑text content. Given that browsers will execute the injected onerror handler, the impact is widespread for any user who views the compromised page.