EUVD-2026-36573Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires a low-privileged CMS account to set the display name (PR:L), passive victim interaction to trigger (UI:R), scope change to victim browser (S:C), no server-side confidentiality or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsanitized user display name in draft version tooltip. As of time of publication, no known patched versions are available.
AnalysisAI
Stored cross-site scripting in ApostropheCMS up to and including version 4.29.0 allows an attacker who controls a user account to inject malicious script into the draft version tooltip via an unsanitized display name field. Any editor or administrator who subsequently views that tooltip in the CMS backend will execute the attacker's payload in their browser, enabling session hijacking or unauthorized action execution. No public exploit has been identified at time of analysis and no patched version is available per the vendor advisory.
Technical ContextAI
ApostropheCMS is an open-source content management system built on Node.js. The vulnerability resides in the draft versioning subsystem, specifically the UI tooltip that displays who last modified a draft - this tooltip renders the user's display name without applying output encoding or HTML sanitization. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class: user-controlled data flows from the database into an HTML rendering context without escaping. The CPE cpe:2.3:a:apostrophecms:apostrophe:*:*:*:*:*:*:*:* covers all releases of the apostrophe npm package, confirming the flaw is not isolated to a sub-component. Unlike reflected XSS, this stored variant persists in the database and activates on every qualifying page load - no ongoing attacker interaction is needed after initial payload injection.
RemediationAI
No vendor-released patch has been identified at time of analysis - the advisory explicitly states no known patched versions are available. Monitor https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hvx2-4ghc-j37m and the apostrophe npm changelog for a fix release, and upgrade immediately when one is published. As compensating controls: restrict user self-registration and display-name modification to trusted personnel only, which eliminates external attacker injection at the cost of reduced self-service capability. Enforce a strict Content Security Policy header on the CMS backend (e.g., script-src 'self') to limit what injected scripts can do - note this may interfere with the CMS rich-text editor and requires testing. Audit existing user display names in the database for suspicious HTML or script content and sanitize or remove offending entries. If the draft version tooltip feature can be disabled via configuration or a custom UI override without breaking core workflows, that removal eliminates the specific rendering path until a patch is available.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today