Issue

After updating to Pega Platform 25.1.x, users are unable to edit any KM article with a title containing certain special characters.  

Attempting to edit such an article displays the following error: 

Article Title: HTML tags, links, or scripts are not allowed in the Title or label. Please enter plain text only. 

Symptoms and Impact

Users encounter a validation error when opening an existing KM article for editing if the article title contains one or more restricted special characters. The article cannot be saved until the title is updated to plain text. Articles created before the upgrade are unaffected until an edit is attempted. 

The issue does not affect article titles that contain only alphanumeric characters or unrestricted punctuation. 

Steps to Reproduce

1. Open the KM Authoring Portal and navigate to an article with a title containing a special character (for example, an ampersand or apostrophe). 
2. Select the article.  
3. Click Edit Content .  Result: The following error is displayed and the article cannot be saved: Article Title: HTML tags, links, or scripts are not allowed in the Title or label. Please enter plain text only. 

Root Cause

In Pega Infinity '25.1.x, enhanced security validation was introduced to address a cross-site scripting (XSS) vulnerability identified during security testing. 

The ArticleTitle property (Data-KM-Content.ArticleTitle) uses the KMXSSValidate validation rule to restrict certain characters in article titles. Consequently, existing articles created in earlier versions may fail validation when users attempt to edit them. 

This behavior is an intentional security enhancement designed to prevent potentially malicious script content from being introduced through article titles. 

Restricted characters (characters the XSS filter will reject): 

The exact validation behavior is determined by the KMXSSValidate rule configuration. 

Solution

To restore edit functionality for affected articles while retaining the intended security protection, follow the remediation procedure below. 

Option 1 — Update titles individually 

1. Open Dev Studio and navigate to the ArticleTitle property in the PegaFW-KM-Work class (or your implementation layer override of it). 
2. On the Advanced tab, remove KMXSSValidate from the Use validate field.  
3. Save the property. 
4. Open each affected article and update its title to plain text, removing all restricted characters. 
5. Restore KMXSSValidate to the Use validate field. 
6. Save the property. 
7. Verify that the corrected articles open for editing without errors. 

Option 2 — Bulk replacement 

If many articles are affected, use the bulk text replacement operation on the Content tab in the KM Authoring Portal to search for and replace restricted characters across multiple articles at once, reducing the number of individual edits required. 

Important: Do not permanently remove the KMXSSValidate validation in a production environment. It is a security control. Remove it only temporarily, per the procedure below, and restore it immediately after correcting the affected titles. 

Exceptional Scenario: Language-Specific Character Requirements 

In some languages, characters restricted by the default validation are grammatically required. For example, the apostrophe (') is essential in French article titles and cannot be substituted without affecting spelling and meaning. 

When removing restricted characters from article titles is not a viable option, a targeted customization of KMXSSValidate may be considered to allow specific language-required characters while preserving all other XSS security checks. 

Before implementing a customization: 

1. Confirm the specific characters that must be supported and document the language requirement. 
2. Review the existing KMXSSValidate logic and understand its security purpose before making any changes. 
3. Make only the minimum changes required — do not broaden the allowance beyond the identified characters. 
4. Preserve all existing XSS security checks; assess the security implications of any character you allow. 
5. Test the customized validation thoroughly in a non-production environment before deploying to production. 
6. Follow your organization's security review and change-management procedures. 

Do not remove XSS protection entirely to accommodate language-specific requirements. Any customization must retain appropriate security validation. 

References

Pega Security Advisory O25 — Vulnerability Remediation Note