DailyCVE@dailycve
🟠 ApostropheCMS, Stored XSS, #CVE-2026-112958 (Medium) -DC-Oct2026-3546 https://dailycve.com/apostrophecms-stored-xss-cve-2026-112958-medium-dc-oct2026-3546/
0000018
244 followersView on X
CVE-2026-112958
LOWCVSS 5.4 · MEDIUMImmediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered. This issue is fixed in version 4.34.0.
0.0/ 10 priority
Sources & remediation
Other references
- https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
- https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
- https://github.com/apostrophecms/apostrophe/releases/tag/[email protected]
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-7jg5-frgc-c67w
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-7jg5-frgc-c67w
Weakness type (CWE)
CWE-79
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE