ApostropheCMS CLI CVE-2026-42853

Exploitation requires the following specific, concrete conditions: (1) @apostrophecms/cli package installed and the apos create command executed; (2) The attacker must influence the password input during the interactive prompt - this occurs either via direct user interaction (social engineering, malicious documentation) or by providing malicious input to an automated script that runs 'apos create' non-interactively; (3) The user running 'apos create' must have sufficient privileges to execute arbitrary commands (typically any local user can do this, but impact depends on that user's privilege level - Docker and sudo group membership shown in PoC amplifies impact); (4) No input validation, sanitization, or escaping is applied to response.pw before shell execution. Limiting factors: Attack is LOCAL ONLY (AV:L), not remotely exploitable over network; HIGH PRIVILEGE context (PR:H) suggests the vulnerability is most impactful when the user running CLI has elevated group memberships; USER INTERACTION (UI:R) required to influence password prompt input, either through direct instruction or script parameter injection. Default configuration of the package is vulnerable - no special flags or configuration settings disable the vulnerability.

CVSS 6.5 (AV:L/AC:L/PR:H/UI:R) indicates local attack vector with high privileges required and user interaction necessary - this significantly limits real-world exposure compared to network-based vectors. However, the attack surface is developers running 'apos create' commands during project setup, often in CI/CD pipelines or shared development environments where privilege levels may be elevated (as evidenced by POC showing sudo and docker group membership). EPSS score not provided in input. Exploitation requires either social engineering to convince a user to enter malicious input, or automation scripts that accept password input from untrusted sources. The combination of CVSS constraints (PR:H, UI:R) and local-only attack vector means this is NOT an immediate remote mass-exploitation risk, but poses significant insider threat and supply-chain attack risk in development environments. No KEV status or active exploitation reports provided; however, publicly available PoC reduces exploitation barriers. The fact that 'all current versions' are listed as vulnerable without a confirmed fixed version suggests patch availability may be pending or limited.

A developer is instructed to create a new ApostropheCMS project using 'apos create mysite'. When prompted for the admin password, instead of entering a legitimate password, the attacker (via social engineering, malicious documentation, or compromised tutorial) instructs the developer to paste a payload like '; id > /tmp/apos_rce_proof.txt; echo '. The command is executed in the developer's shell context with their privileges (potentially including sudo and docker group membership), allowing file creation, credential theft, or system compromise.