Db Connect
Monthly
Authenticated users with view-draft access can permanently break request handling across the entire ApostropheCMS Node.js process by sending a piece-type REST GET request whose `project` query contains an exclusion key such as `constructor.prototype.hasOwnProperty`. The malicious key reaches the SQLite, PostgreSQL, or multipostgres adapter's `unsetNestedField` helper, which walks the dotted path into `Object.prototype` and deletes a shared runtime method - surviving beyond the request and requiring a process restart to recover. Exploitation requires a logged-in account (every editing role has view-draft; guestApiAccess reduces this to any logged-in user) and a SQL-backed adapter with a matching document; installations on the default MongoDB adapter are not affected. No public exploit code or KEV-listed active exploitation was identified at time of analysis.
Authenticated users with view-draft access can permanently break request handling across the entire ApostropheCMS Node.js process by sending a piece-type REST GET request whose `project` query contains an exclusion key such as `constructor.prototype.hasOwnProperty`. The malicious key reaches the SQLite, PostgreSQL, or multipostgres adapter's `unsetNestedField` helper, which walks the dotted path into `Object.prototype` and deletes a shared runtime method - surviving beyond the request and requiring a process restart to recover. Exploitation requires a logged-in account (every editing role has view-draft; guestApiAccess reduces this to any logged-in user) and a SQL-backed adapter with a matching document; installations on the default MongoDB adapter are not affected. No public exploit code or KEV-listed active exploitation was identified at time of analysis.