StackRadarChart IndexLive demo

CVE-2026-63670

Medium

Advisory

Published 3 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.1; base score, highest
EPSS: 0.003; 21st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 61; of 17,781 indexed, latest versions
Container images: 52; deployed by those charts
Fix available: 1 of 1; affected package

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

Carried by container images the latest versions of 61 of 17,781 indexed charts deploy, on 52 images.

Affected package	Affected versions	Fixed in	Images
sanitize-htmlnpm	1.14.1, 1.18.5, 1.19.1, 1.27.5+10 more	2.17.6	52

OSV records: GHSA-jxwj-j7wr-gfrw

Charts affected

61 by stars

Chart

Latest

Affected images

Radar Score

speckle-server-branch-hotfix-2.19.1speckle

2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of 5 See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-63670.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	4b6a0750d5aa	sanitize-html@2.12.1	2.17.6

Open the chart page →

16,368

speckle-server-branch-hotfix-2.20.2speckle

2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of 5 See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-63670.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	52f8eabf5cea	sanitize-html@2.12.1	2.17.6

Open the chart page →

16,400

speckle-server-branch-testingspeckle

2.17.14-branch.testing.72707.921a5f8

1 of 5 See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry CVE-2026-63670.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.17.14-branch.testing.72707.921a5f8	49d10dcdfb91	sanitize-html@2.8.1	2.17.6

Open the chart page →

14,679

speckle-server-branch-testing1speckle

2.20.6-branch.testing1.154030-9b09114

1 of 5 See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-63670.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.20.6-branch.testing1.154030-9b09114	e8413f57b327	sanitize-html@2.12.1	2.17.6

Open the chart page →

16,400

speckle-server-branch-testing2speckle

2.18.11-branch.testing2.88634-335d469

1 of 5 See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry CVE-2026-63670.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.18.11-branch.testing2.88634-335d469	bf6a501b2210	sanitize-html@2.12.1	2.17.6

Open the chart page →

14,221

speckle-server-branch-testing3speckle

2.18.12-branch.testing3.88744-f55b341

1 of 5 See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry CVE-2026-63670.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.18.12-branch.testing3.88744-f55b341	89a5872375f9	sanitize-html@2.12.1	2.17.6

Open the chart page →

14,221

speckle-server-branch-testing4speckle

2.20.2-branch.testing4.134160-9fad4b2

1 of 5 See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-63670.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.20.2-branch.testing4.134160-9fad4b2	687f43ab16f3	sanitize-html@2.12.1	2.17.6

Open the chart page →

16,019

speckle-server-branch-testing5speckle

2.21.3-branch.testing5.219631-2153bef

1 of 5 See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-63670.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.21.3-branch.testing5.219631-2153bef	8fd157733393	sanitize-html@2.12.1	2.17.6

Open the chart page →

15,635

speckle-server-branch-testing6speckle

2.25.10-branch.testing6.645-b125c1e

1 of 4 See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-63670.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.25.10-branch.testing6.645-b125c1e	75cdf256067b	sanitize-html@2.12.1	2.17.6

Open the chart page →

11,100

strapistrapi-xmv

1 of 1 See more

strapi strapi-xmv 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-63670.

Container image	Digest	Package	Fixed in
ghcr.io/xmv-solutions-gmbh/strapi :latest	a288b4571142	sanitize-html@2.13.0	2.17.6

Open the chart page →

676

trudesktechpreta

1 of 3 See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-63670.

Container image	Digest	Package	Fixed in
polonel/trudesk :1.2.6	0cf6513f6fe3	sanitize-html@2.7.0	2.17.6

Open the chart page →

4,017

Container images carrying it

52 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/xmv-solutions-gmbh/strapi :latest	a288b4571142	sanitize-html@2.13.0	2.17.6	1
quay.io/flomesh/flomesh-console-ubi8 :0.70.0-30	ce6938ff6709	sanitize-html@2.3.3	2.17.6	1