Vulnerability-Lookup

RHSA-2026:46598

Vulnerability from csaf_redhat - Published: 2026-07-27 12:20 - Updated: 2026-07-27 22:48

Summary

Red Hat Security Advisory: OpenShift Virtualization v4.20 Images

Severity

Important

Notes

Topic: Red Hat OpenShift Virtualization release v4.20 is now available with updates to packages and images that fix several bugs and add enhancements.

Details: OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization v4.20 images.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-44990

A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:2ab73f1637a834299e0513415cf7c082307a691d185b361fafba16dd798edd45_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:523e394687b06da9fd277040a651802818f754f26f93ea4a0e38e359f8d93a27_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d3ab1d43bf8e957f4f99ed88bd78deb15176ee24e22ecdfcbbff39005776f1fc_s390x	—	Vendor Fix fix Workaround

Threats

Impact Important

References

9 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:46598	self
https://access.redhat.com/security/cve/CVE-2026-44990	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-44990	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488565	external
https://www.cve.org/CVERecord?id=CVE-2026-44990	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44990	external
https://github.com/apostrophecms/apostrophe/secur…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Virtualization release v4.20 is now available with updates to packages and images that fix several bugs and add enhancements.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift Virtualization is Red Hat\u0027s virtualization solution designed for Red Hat OpenShift Container Platform.\n\nThis advisory contains OpenShift Virtualization v4.20 images.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:46598",
        "url": "https://access.redhat.com/errata/RHSA-2026:46598"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44990",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44990"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46598.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Virtualization v4.20 Images",
    "tracking": {
      "current_release_date": "2026-07-27T22:48:33+00:00",
      "generator": {
        "date": "2026-07-27T22:48:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:46598",
      "initial_release_date": "2026-07-27T12:20:23+00:00",
      "revision_history": [
        {
          "date": "2026-07-27T12:20:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-27T12:20:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-27T22:48:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Container Native Virtualization 4.20",
                "product": {
                  "name": "Red Hat Container Native Virtualization 4.20",
                  "product_id": "Red Hat Container Native Virtualization 4.20",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:container_native_virtualization:4.20::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Container Native Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:2ab73f1637a834299e0513415cf7c082307a691d185b361fafba16dd798edd45_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:2ab73f1637a834299e0513415cf7c082307a691d185b361fafba16dd798edd45_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:2ab73f1637a834299e0513415cf7c082307a691d185b361fafba16dd798edd45_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kubevirt-console-plugin-rhel9@sha256%3A2ab73f1637a834299e0513415cf7c082307a691d185b361fafba16dd798edd45?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9\u0026tag=1784629964"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:523e394687b06da9fd277040a651802818f754f26f93ea4a0e38e359f8d93a27_arm64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:523e394687b06da9fd277040a651802818f754f26f93ea4a0e38e359f8d93a27_arm64",
                  "product_id": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:523e394687b06da9fd277040a651802818f754f26f93ea4a0e38e359f8d93a27_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kubevirt-console-plugin-rhel9@sha256%3A523e394687b06da9fd277040a651802818f754f26f93ea4a0e38e359f8d93a27?arch=arm64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9\u0026tag=1784629964"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d3ab1d43bf8e957f4f99ed88bd78deb15176ee24e22ecdfcbbff39005776f1fc_s390x",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d3ab1d43bf8e957f4f99ed88bd78deb15176ee24e22ecdfcbbff39005776f1fc_s390x",
                  "product_id": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d3ab1d43bf8e957f4f99ed88bd78deb15176ee24e22ecdfcbbff39005776f1fc_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kubevirt-console-plugin-rhel9@sha256%3Ad3ab1d43bf8e957f4f99ed88bd78deb15176ee24e22ecdfcbbff39005776f1fc?arch=s390x\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9\u0026tag=1784629964"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:2ab73f1637a834299e0513415cf7c082307a691d185b361fafba16dd798edd45_amd64 as a component of Red Hat Container Native Virtualization 4.20",
          "product_id": "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:2ab73f1637a834299e0513415cf7c082307a691d185b361fafba16dd798edd45_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:2ab73f1637a834299e0513415cf7c082307a691d185b361fafba16dd798edd45_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.20"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:523e394687b06da9fd277040a651802818f754f26f93ea4a0e38e359f8d93a27_arm64 as a component of Red Hat Container Native Virtualization 4.20",
          "product_id": "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:523e394687b06da9fd277040a651802818f754f26f93ea4a0e38e359f8d93a27_arm64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:523e394687b06da9fd277040a651802818f754f26f93ea4a0e38e359f8d93a27_arm64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.20"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d3ab1d43bf8e957f4f99ed88bd78deb15176ee24e22ecdfcbbff39005776f1fc_s390x as a component of Red Hat Container Native Virtualization 4.20",
          "product_id": "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d3ab1d43bf8e957f4f99ed88bd78deb15176ee24e22ecdfcbbff39005776f1fc_s390x"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d3ab1d43bf8e957f4f99ed88bd78deb15176ee24e22ecdfcbbff39005776f1fc_s390x",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.20"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44990",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-06-12T21:02:24.911971+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488565"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. The `sanitize-html` library, used in Red Hat products, is susceptible to a stored Cross-Site Scripting (XSS) bypass. Malicious content within a disallowed `xmp` element can be rendered as live HTML or JavaScript due to a sanitizer bypass in the default configuration. This can lead to arbitrary code execution or information disclosure when affected content is viewed.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:2ab73f1637a834299e0513415cf7c082307a691d185b361fafba16dd798edd45_amd64",
          "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:523e394687b06da9fd277040a651802818f754f26f93ea4a0e38e359f8d93a27_arm64",
          "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d3ab1d43bf8e957f4f99ed88bd78deb15176ee24e22ecdfcbbff39005776f1fc_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44990"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488565",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488565"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44990",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44990"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990"
        },
        {
          "category": "external",
          "summary": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643",
          "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643"
        }
      ],
      "release_date": "2026-06-12T20:39:47.065000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T12:20:23+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:2ab73f1637a834299e0513415cf7c082307a691d185b361fafba16dd798edd45_amd64",
            "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:523e394687b06da9fd277040a651802818f754f26f93ea4a0e38e359f8d93a27_arm64",
            "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d3ab1d43bf8e957f4f99ed88bd78deb15176ee24e22ecdfcbbff39005776f1fc_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46598"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:2ab73f1637a834299e0513415cf7c082307a691d185b361fafba16dd798edd45_amd64",
            "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:523e394687b06da9fd277040a651802818f754f26f93ea4a0e38e359f8d93a27_arm64",
            "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d3ab1d43bf8e957f4f99ed88bd78deb15176ee24e22ecdfcbbff39005776f1fc_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:2ab73f1637a834299e0513415cf7c082307a691d185b361fafba16dd798edd45_amd64",
            "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:523e394687b06da9fd277040a651802818f754f26f93ea4a0e38e359f8d93a27_arm64",
            "Red Hat Container Native Virtualization 4.20:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d3ab1d43bf8e957f4f99ed88bd78deb15176ee24e22ecdfcbbff39005776f1fc_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass"
    }
  ]
}

CVE-2026-44990 (GCVE-0-2026-44990)

Vulnerability from cvelistv5 – Published: 2026-06-12 20:39 – Updated: 2026-07-27 12:05

Title

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Summary

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

14 references

URL	Tags
https://github.com/apostrophecms/apostrophe/secur…	x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2026-44990	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2488565	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:41064	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36882	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42146	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43052	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42796	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41066	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41031	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41055	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36883	vendor-advisoryx_refsource_REDHAT

Impacted products

16 products

Vendor	Product	Version
apostrophecms	sanitize-html	Affected: < 2.17.4
Red Hat	multicluster engine for Kubernetes 2.6	Unaffected: 1783351002 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.6::el9
Red Hat	multicluster engine for Kubernetes 2.9	Unaffected: 1783348181 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.9::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.11	Unaffected: 1783350952 , < * (rpm) cpe:/a:redhat:acm:2.11::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.14	Unaffected: 1783451729 , < * (rpm) cpe:/a:redhat:acm:2.14::el9
Red Hat	Red Hat Quay 3.1	Unaffected: 1783750447 , < * (rpm) cpe:/a:redhat:quay:3.10::el8
Red Hat	Red Hat Quay 3.12	Unaffected: 1783751865 , < * (rpm) Unaffected: 1784353904 , < * (rpm) cpe:/a:redhat:quay:3.12::el8
Red Hat	Red Hat Quay 3.15	Unaffected: 1784351966 , < * (rpm) cpe:/a:redhat:quay:3.15::el8
Red Hat	Red Hat Quay 3.16	Unaffected: 1783955846 , < * (rpm) cpe:/a:redhat:quay:3.16::el9
Red Hat	Red Hat Quay 3.9	Unaffected: 1784125838 , < * (rpm) cpe:/a:redhat:quay:3.9::el8
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44990",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T13:04:32.468259Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-15T13:04:56.814Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/console-mce-rhel9",
            "product": "multicluster engine for Kubernetes 2.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783351002",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/console-mce-rhel9",
            "product": "multicluster engine for Kubernetes 2.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783348181",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/console-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783350952",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/console-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783451729",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.10::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783750447",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783751865",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784353904",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784351966",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel9",
            "product": "Red Hat Quay 3.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783955846",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.9::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784125838",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector-contrib",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mlflow-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-agent-installer-ui-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-console",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-console-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/dashboard-rhel9",
            "product": "Red Hat OpenShift Dev Spaces",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "affected",
            "packageName": "container-native-virtualization/kubevirt-console-plugin-rhel9",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs-sanitize-html",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "packageName": "satellite/iop-advisor-frontend-rhel9",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "packageName": "satellite/iop-host-inventory-frontend-rhel9",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "packageName": "satellite/iop-vulnerability-frontend-rhel9",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-12T20:39:47.065Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T12:05:28.994Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-44990"
          },
          {
            "name": "RHBZ#2488565",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488565"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44990.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41064"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36882"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42146"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43052"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42796"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41066"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41031"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40262"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41055"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36883"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:41064: Red Hat Advanced Cluster Management for Kubernetes 2.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36882: Red Hat Advanced Cluster Management for Kubernetes 2.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42146: Red Hat Quay 3.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43052: Red Hat Quay 3.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42796: Red Hat Quay 3.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41066: Red Hat Quay 3.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41031: Red Hat Quay 3.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40262: Red Hat Quay 3.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41055: multicluster engine for Kubernetes 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36883: multicluster engine for Kubernetes 2.9.0"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-12T21:02:24.911Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-12T20:39:47.065Z",
            "value": "Made public."
          }
        ],
        "title": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sanitize-html",
          "vendor": "apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.17.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: \u0027discard\u0027` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T20:39:47.065Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643"
        }
      ],
      "source": {
        "advisory": "GHSA-rpr9-rxv7-x643",
        "discovery": "UNKNOWN"
      },
      "title": "Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44990",
    "datePublished": "2026-06-12T20:39:47.065Z",
    "dateReserved": "2026-05-08T16:23:33.265Z",
    "dateUpdated": "2026-07-27T12:05:28.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

RHSA-2026:46598

CVE-2026-44990 (GCVE-0-2026-44990)

Tags

Sightings

Nomenclature