Apostrophecms
Monthly
Prototype pollution in ApostropheCMS 4.32.0 and earlier enables an authenticated editor to trigger a persistent, process-wide denial of service via a single PATCH REST API request. By sending `{ "toString.call": "x" }` to `PATCH /api/v1/article/:id`, the attacker walks the JavaScript prototype chain through `apos.util.set()` into the shared `Object.prototype.toString` function object and shadows its `call` method, breaking every subsequent `Object.prototype.toString.call()` invocation in Node.js - including those inside the MongoDB driver - until the server process is manually restarted. No separate proof-of-concept repository has been published, but the exact attack payload is fully disclosed in the public GitHub security advisory GHSA-vmg4-6gfg-83qx and the upstream commit diff, and active exploitation has not been confirmed by CISA KEV.
Prototype pollution in ApostropheCMS versions up to and including 4.30.0 allows an authenticated editor to poison Object.prototype via the $pullAll patch operator, ultimately bypassing authorization on all piece-type REST API endpoints for unauthenticated requests until the Node.js process restarts. The flaw stems from apos.util.set() failing to sanitize __proto__ in dot-notation paths, and no public exploit identified at time of analysis but the advisory describes a confirmed exploitation gadget in publicApiCheck(). No vendor-released patch identified at time of analysis, making this an open-window risk for any internet-exposed editor account.
Stored cross-site scripting in the @apostrophecms/seo plugin (versions ≤1.4.2) allows any user holding the default editor role to inject arbitrary JavaScript that executes in every visitor's browser. The seoGoogleTrackingId and seoGoogleTagManager fields are interpolated directly into inline <script> tag bodies via template literals with no sanitization, turning legitimate analytics configuration into a persistent payload delivery channel. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
Stored cross-site scripting in ApostropheCMS SEO fields permits an authenticated attacker to inject arbitrary JavaScript that executes in the context of any authenticated user viewing the crafted page. This can be leveraged to exfiltrate sensitive user data (usernames, emails, roles) and perform actions as the victim via internal APIs. Public exploit code exists, but no active exploitation has been reported; a patch is available.
Stored XSS in sanitize-html versions 1.9.0 through 2.17.6 allows authenticated low-privileged users to inject executable JavaScript via SVG SMIL animation elements that survive the library's scheme-policy sanitization. The sanitizer validates the `values` attribute as a single flat URL, missing that `attributeName="href"` gives `values` URI-list semantics under SVG SMIL; a payload of `#safe;javascript:alert(1)` passes the scheme check on its leading fragment while the `javascript:` entry survives intact. When a victim clicks the rendered link, the browser resolves the later entry and executes script in the application's origin. A working proof-of-concept is publicly disclosed in the GHSA advisory; no CISA KEV listing at time of analysis.
Path traversal in ApostropheCMS's import-export module (versions prior to 3.6.2) allows an authenticated contributor to exfiltrate host files and expose them publicly via the CMS uploads URL. By importing a crafted `.tar.gz` archive with `../` sequences embedded in the `_id`, `name`, or `extension` fields of `aposAttachments.json`, an attacker causes the module to reconstruct a source path that escapes the extraction directory, reading any host file whose name ends with an allow-listed extension and copying it to a publicly accessible, unauthenticated uploads endpoint. No public exploit is identified at time of analysis; vendor-released patch is available in version 3.6.2.
Stored cross-site scripting in ApostropheCMS prior to 2.17.6 enables execution of arbitrary JavaScript in victim browsers through a parser-differential bypass in the bundled sanitize-html library. When `textarea` or `xmp` is included in a site's `allowedTags` configuration, a payload using a trailing solidus on the closing tag - such as `</textarea/>` - is treated as text by htmlparser2 10.x but as a valid close by spec-compliant browsers, causing injected markup like `<img onerror=...>` to execute as live HTML on page load. No public exploit repository has been identified and the vulnerability is not listed in the CISA KEV catalog, but a functional proof-of-concept payload is fully described in the upstream security advisory GHSA-jxwj-j7wr-gfrw; the fix ships in version 2.17.6.
Integrity bypass in ApostropheCMS page management allows authenticated low-privileged editors to move pages into restricted subtrees they have no create rights over, and indirectly re-rank admin-only sibling pages via an unchecked database updateMany call. All deployments running ApostropheCMS prior to 4.32.0 are affected; the flaw exists in the REST page update endpoint and requires no special configuration to reach. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the attack path through documented REST parameters is straightforward for any CMS insider.
Server-Side Request Forgery in ApostropheCMS through version 4.30.0 allows unauthenticated remote attackers to pivot the Node.js application process into issuing outbound HTTP requests to arbitrary hosts on the internal network when the `prettyUrls` SEO feature is explicitly enabled on the `@apostrophecms/file` module. The attack exploits the raw `Host` HTTP request header, which the pretty-URL handler uses verbatim to construct and `fetch()` an upstream URL, streaming the full HTTP response - status code, headers, and body - back to the requester. Practical impact is constrained to blind SSRF (network-topology probing via response-code and timing oracles, and verbose proxy or WAF error-body disclosure) rather than arbitrary data exfiltration; no patch exists at time of publication and no public exploit has been identified.
Cross-site scripting in sanitize-html prior to 2.17.5 allows low-privileged attackers to inject executable `javascript:` URIs through HTML attributes that the library's scheme-blocking logic never inspects. The `naughtyHref()` function gates dangerous URI schemes only for attributes listed in `allowedSchemesAppliedToAttributes` (defaulting to `href`, `src`, and `cite`), leaving attributes such as `action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, and `lowsrc` entirely unchecked. Applications that explicitly permit any of these attributes in their sanitize-html configuration are vulnerable; no public exploit code has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Stored cross-site scripting in ApostropheCMS up to and including version 4.29.0 allows an attacker who controls a user account to inject malicious script into the draft version tooltip via an unsanitized display name field. Any editor or administrator who subsequently views that tooltip in the CMS backend will execute the attacker's payload in their browser, enabling session hijacking or unauthorized action execution. No public exploit has been identified at time of analysis and no patched version is available per the vendor advisory.
Information disclosure in ApostropheCMS 4.28.0 and earlier allows unauthenticated attackers to extract distinct field values via the choices and counts REST API query parameters, bypassing publicApiProjection restrictions. The vulnerability exposes sensitive schema field values, including those protected by viewPermission, and a proof-of-concept exploit exists, though no active exploitation is confirmed.
Stored cross-site scripting in ApostropheCMS versions 4.28.0 and prior allows authenticated editors to inject arbitrary JavaScript into the color-field widget, executing in the browsers of all site visitors. Exploitation enables mass session hijacking and privilege escalation to administrative control; publicly available proof-of-concept exploit code exists, though no active exploitation has been confirmed. The vulnerability has been patched in version 4.29.0.
Information disclosure in ApostropheCMS 4.28.0 and earlier allows unauthenticated attackers to bypass admin-configured field restrictions on the piece-type REST API, exposing sensitive content such as internal notes or draft metadata. Public exploit code is available, though the EPSS score (0.09%) indicates low current exploitation probability; no active exploitation has been confirmed.
Cross-site scripting (XSS) in ApostropheCMS 4.28.0 and sanitize-html 2.17.1 allows remote attackers to bypass HTML tag filtering and inject arbitrary tags through entity-encoded payloads in textarea and option elements. A regression in the sanitize-html parser incorrectly assumes htmlparser2 does not decode entities within non-text elements, causing encoded HTML to be decoded and written directly to output without sanitization. Exploitation requires non-default configurations where textarea or option tags are in the allowedTags list, commonly found in form builders, and user interaction to submit form content. No active exploitation has been identified at time of analysis, but the vulnerability is trivial to exploit once configuration conditions are met.
User enumeration via a timing side channel in ApostropheCMS versions 4.28.0 and prior allows unauthenticated attackers to identify valid usernames and emails. The password reset endpoint fails to normalize response time when a valid user is found, enabling an attacker to distinguish valid accounts from invalid ones by repeatedly probing the endpoint. This can facilitate credential stuffing and targeted phishing against instances that have explicitly enabled the password reset feature.
'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Prototype pollution in ApostropheCMS 4.32.0 and earlier enables an authenticated editor to trigger a persistent, process-wide denial of service via a single PATCH REST API request. By sending `{ "toString.call": "x" }` to `PATCH /api/v1/article/:id`, the attacker walks the JavaScript prototype chain through `apos.util.set()` into the shared `Object.prototype.toString` function object and shadows its `call` method, breaking every subsequent `Object.prototype.toString.call()` invocation in Node.js - including those inside the MongoDB driver - until the server process is manually restarted. No separate proof-of-concept repository has been published, but the exact attack payload is fully disclosed in the public GitHub security advisory GHSA-vmg4-6gfg-83qx and the upstream commit diff, and active exploitation has not been confirmed by CISA KEV.
Prototype pollution in ApostropheCMS versions up to and including 4.30.0 allows an authenticated editor to poison Object.prototype via the $pullAll patch operator, ultimately bypassing authorization on all piece-type REST API endpoints for unauthenticated requests until the Node.js process restarts. The flaw stems from apos.util.set() failing to sanitize __proto__ in dot-notation paths, and no public exploit identified at time of analysis but the advisory describes a confirmed exploitation gadget in publicApiCheck(). No vendor-released patch identified at time of analysis, making this an open-window risk for any internet-exposed editor account.
Stored cross-site scripting in the @apostrophecms/seo plugin (versions ≤1.4.2) allows any user holding the default editor role to inject arbitrary JavaScript that executes in every visitor's browser. The seoGoogleTrackingId and seoGoogleTagManager fields are interpolated directly into inline <script> tag bodies via template literals with no sanitization, turning legitimate analytics configuration into a persistent payload delivery channel. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
Stored cross-site scripting in ApostropheCMS SEO fields permits an authenticated attacker to inject arbitrary JavaScript that executes in the context of any authenticated user viewing the crafted page. This can be leveraged to exfiltrate sensitive user data (usernames, emails, roles) and perform actions as the victim via internal APIs. Public exploit code exists, but no active exploitation has been reported; a patch is available.
Stored XSS in sanitize-html versions 1.9.0 through 2.17.6 allows authenticated low-privileged users to inject executable JavaScript via SVG SMIL animation elements that survive the library's scheme-policy sanitization. The sanitizer validates the `values` attribute as a single flat URL, missing that `attributeName="href"` gives `values` URI-list semantics under SVG SMIL; a payload of `#safe;javascript:alert(1)` passes the scheme check on its leading fragment while the `javascript:` entry survives intact. When a victim clicks the rendered link, the browser resolves the later entry and executes script in the application's origin. A working proof-of-concept is publicly disclosed in the GHSA advisory; no CISA KEV listing at time of analysis.
Path traversal in ApostropheCMS's import-export module (versions prior to 3.6.2) allows an authenticated contributor to exfiltrate host files and expose them publicly via the CMS uploads URL. By importing a crafted `.tar.gz` archive with `../` sequences embedded in the `_id`, `name`, or `extension` fields of `aposAttachments.json`, an attacker causes the module to reconstruct a source path that escapes the extraction directory, reading any host file whose name ends with an allow-listed extension and copying it to a publicly accessible, unauthenticated uploads endpoint. No public exploit is identified at time of analysis; vendor-released patch is available in version 3.6.2.
Stored cross-site scripting in ApostropheCMS prior to 2.17.6 enables execution of arbitrary JavaScript in victim browsers through a parser-differential bypass in the bundled sanitize-html library. When `textarea` or `xmp` is included in a site's `allowedTags` configuration, a payload using a trailing solidus on the closing tag - such as `</textarea/>` - is treated as text by htmlparser2 10.x but as a valid close by spec-compliant browsers, causing injected markup like `<img onerror=...>` to execute as live HTML on page load. No public exploit repository has been identified and the vulnerability is not listed in the CISA KEV catalog, but a functional proof-of-concept payload is fully described in the upstream security advisory GHSA-jxwj-j7wr-gfrw; the fix ships in version 2.17.6.
Integrity bypass in ApostropheCMS page management allows authenticated low-privileged editors to move pages into restricted subtrees they have no create rights over, and indirectly re-rank admin-only sibling pages via an unchecked database updateMany call. All deployments running ApostropheCMS prior to 4.32.0 are affected; the flaw exists in the REST page update endpoint and requires no special configuration to reach. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the attack path through documented REST parameters is straightforward for any CMS insider.
Server-Side Request Forgery in ApostropheCMS through version 4.30.0 allows unauthenticated remote attackers to pivot the Node.js application process into issuing outbound HTTP requests to arbitrary hosts on the internal network when the `prettyUrls` SEO feature is explicitly enabled on the `@apostrophecms/file` module. The attack exploits the raw `Host` HTTP request header, which the pretty-URL handler uses verbatim to construct and `fetch()` an upstream URL, streaming the full HTTP response - status code, headers, and body - back to the requester. Practical impact is constrained to blind SSRF (network-topology probing via response-code and timing oracles, and verbose proxy or WAF error-body disclosure) rather than arbitrary data exfiltration; no patch exists at time of publication and no public exploit has been identified.
Cross-site scripting in sanitize-html prior to 2.17.5 allows low-privileged attackers to inject executable `javascript:` URIs through HTML attributes that the library's scheme-blocking logic never inspects. The `naughtyHref()` function gates dangerous URI schemes only for attributes listed in `allowedSchemesAppliedToAttributes` (defaulting to `href`, `src`, and `cite`), leaving attributes such as `action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, and `lowsrc` entirely unchecked. Applications that explicitly permit any of these attributes in their sanitize-html configuration are vulnerable; no public exploit code has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Stored cross-site scripting in ApostropheCMS up to and including version 4.29.0 allows an attacker who controls a user account to inject malicious script into the draft version tooltip via an unsanitized display name field. Any editor or administrator who subsequently views that tooltip in the CMS backend will execute the attacker's payload in their browser, enabling session hijacking or unauthorized action execution. No public exploit has been identified at time of analysis and no patched version is available per the vendor advisory.
Information disclosure in ApostropheCMS 4.28.0 and earlier allows unauthenticated attackers to extract distinct field values via the choices and counts REST API query parameters, bypassing publicApiProjection restrictions. The vulnerability exposes sensitive schema field values, including those protected by viewPermission, and a proof-of-concept exploit exists, though no active exploitation is confirmed.
Stored cross-site scripting in ApostropheCMS versions 4.28.0 and prior allows authenticated editors to inject arbitrary JavaScript into the color-field widget, executing in the browsers of all site visitors. Exploitation enables mass session hijacking and privilege escalation to administrative control; publicly available proof-of-concept exploit code exists, though no active exploitation has been confirmed. The vulnerability has been patched in version 4.29.0.
Information disclosure in ApostropheCMS 4.28.0 and earlier allows unauthenticated attackers to bypass admin-configured field restrictions on the piece-type REST API, exposing sensitive content such as internal notes or draft metadata. Public exploit code is available, though the EPSS score (0.09%) indicates low current exploitation probability; no active exploitation has been confirmed.
Cross-site scripting (XSS) in ApostropheCMS 4.28.0 and sanitize-html 2.17.1 allows remote attackers to bypass HTML tag filtering and inject arbitrary tags through entity-encoded payloads in textarea and option elements. A regression in the sanitize-html parser incorrectly assumes htmlparser2 does not decode entities within non-text elements, causing encoded HTML to be decoded and written directly to output without sanitization. Exploitation requires non-default configurations where textarea or option tags are in the allowedTags list, commonly found in form builders, and user interaction to submit form content. No active exploitation has been identified at time of analysis, but the vulnerability is trivial to exploit once configuration conditions are met.
User enumeration via a timing side channel in ApostropheCMS versions 4.28.0 and prior allows unauthenticated attackers to identify valid usernames and emails. The password reset endpoint fails to normalize response time when a valid user is found, enabling an attacker to distinguish valid accounts from invalid ones by repeatedly probing the endpoint. This can facilitate credential stuffing and targeted phishing against instances that have explicitly enabled the password reset feature.
'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.