CVE-2026-112958— ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
Quick assessment
Affected
apostrophecms apostrophe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ApostropheCMS 是一个开源的 Node.js 内容管理系统。在 4.34.0 版本之前，由于包装序列化器未对 HTML 属性进行编码，项目定义的自由格式小工具样式字段可能将编辑器控制的引号带入内联样式属性中。该引号可终止样式属性，并在渲染已发布内容（或由高权限用户查看的受影响草稿）时注入可执行属性。此问题已在 4.34.0 版本中修复。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112958
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
Source: CVE Program / CVE List V5
Vulnerability Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered. This issue is fixed in version 4.34.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| apostrophecms | apostrophe | < 4.34.0 | - |
|
II. Public POCs for CVE-2026-112958
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112958
请登录查看更多情报信息。
Other References for CVE-2026-112958 (4)
Same Patch Batch · apostrophecms · 2026-10-20 · 33 CVEs total
| CVE-2026-113711 | 7.5 HIGH | ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing i |
| CVE-2026-113658 | 7.5 HIGH | ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system te |
| CVE-2026-113666 | 7.1 HIGH | ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophe |
| CVE-2026-113653 | 6.9 MEDIUM | ApostropheCMS: The general public can access @apostrophecms/user objects via a relationshi |
| CVE-2026-113649 | 6.5 MEDIUM | ApostropheCMS: Import API bypasses publication roles for protected content |
| CVE-2026-112956 | 6.5 MEDIUM | ApostropheCMS: Archive duplicate continuation lets contributors overwrite published conten |
| CVE-2026-112955 | 6.5 MEDIUM | ApostropheCMS: Import archives can exhaust server storage and deny service |
| CVE-2026-113659 | 6.1 MEDIUM | ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-base |
| CVE-2026-112953 | 6.0 MEDIUM | ApostropheCMS: Exposure of Sensitive Information via predictable export filenames |
| CVE-2026-113710 | 5.9 MEDIUM | ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unl |
| CVE-2026-113652 | 5.6 MEDIUM | ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attac |
| CVE-2026-112951 | 5.4 MEDIUM | ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb |
| CVE-2026-113662 | 5.4 MEDIUM | ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import ma |
| CVE-2026-113661 | 5.4 MEDIUM | ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships |
| CVE-2026-113669 | 5.3 MEDIUM | ApostropheCMS: Cross-domain session token in URL confers session takeover |
| CVE-2026-113670 | 5.3 MEDIUM | ApostropheCMS: Page REST API authorization bypass |
| CVE-2026-113667 | 5.3 MEDIUM | ApostropheCMS: CAPTCHA response token not URL-encoded |
| CVE-2026-113668 | 5.3 MEDIUM | ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling |
| CVE-2026-113656 | 5.3 MEDIUM | ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS |
| CVE-2026-113664 | 5.3 MEDIUM | ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substrin |
Showing top 20 of 33 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: apostrophe
-
CVE-2026-113711
ApostropheCMS: Unauthenticated resource exhaustion via pre-a -
CVE-2026-113710
ApostropheCMS: No Attempt Throttling on Authenticated Passwo -
CVE-2026-113671
ApostropheCMS: Host header controls server-side image fetch -
CVE-2026-113670
ApostropheCMS: Page REST API authorization bypass -
CVE-2026-113669
ApostropheCMS: Cross-domain session token in URL confers ses
Same vendor: apostrophecms
-
CVE-2026-113711
ApostropheCMS: Unauthenticated resource exhaustion via pre-a -
CVE-2026-113710
ApostropheCMS: No Attempt Throttling on Authenticated Passwo -
CVE-2026-113671
ApostropheCMS: Host header controls server-side image fetch -
CVE-2026-113670
ApostropheCMS: Page REST API authorization bypass -
CVE-2026-113669
ApostropheCMS: Cross-domain session token in URL confers ses
Same weakness: CWE-79
-
CVE-2026-113661
ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=r -
CVE-2026-113659
ApostropheCMS: Client-side Prototype Pollution in apos.http. -
CVE-2026-113657
ApostropheCMS sanitize-html: SMIL animation namespace-prefix -
CVE-2026-113654
ApostropheCMS sanitize-html: nonTextTags discard region ends -
CVE-2026-28330
SolarWinds Observability Self-Hosted Cross-Site Scripting Vu
V. Comments for CVE-2026-112958
No comments yet