VulnSocial

CVE-2026-42853Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system. As of time of publication, no known patched versions are available.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-06-14: 2Technical Details · 2026-06-14: 206-14
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-42853 ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vu… https://www.cve.org/CVERecord?id=CVE-2026-42853 ----- Traducción: CVE-2026-42853 Apo… http://infoflow.cloud`

    Post summary

    The short notice announces a command‑injection flaw in ApostropheCMS’s @apostrophecms/cli package (up to v3.6.0) and directs readers to the CVE record.

    0000035
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-42853 ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vu… https://www.cve.org/CVERecord?id=CVE-2026-42853

    Post summary

    The post announces CVE-2026‑42853 as a command‑injection flaw in ApostropheCMS’s @apostrophecms/cli package (up to 3.6.0) with no PoC, patch, or active exploitation discussion.

    00000301
    57.6K followersView on X

Explore more

Back to dashboard