CVE-2026-42853— @apostrophecms/cli apos create 命令注入漏洞
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| apostrophecms | @apostrophecms/cli | <= 3.6.0 | affected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-42853の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input
ソース: NVD (National Vulnerability Database)
脆弱性説明
ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system. As of time of publication, no known patched versions are available.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
ソース: NVD (National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| apostrophecms | @apostrophecms/cli | <= 3.6.0 | - |
II. CVE-2026-42853の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-42853のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-42853 厂商安全公告 (1)
Same Patch Batch · apostrophecms · 2026-06-12 · 10 CVEs total
| CVE-2026-44990 | 9.3 CRITICAL | Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` |
| CVE-2026-53609 | 9.1 CRITICAL | Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that l |
| CVE-2026-53608 | 8.7 HIGH | @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Inje |
| CVE-2026-45013 | 8.1 HIGH | Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Inpu |
| CVE-2026-45012 | 7.6 HIGH | Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/valid |
| CVE-2026-45011 | 7.3 HIGH | Apostrophe has stored XSS via javascript: URL in Image Widget Link |
| CVE-2026-53606 | 5.4 MEDIUM | sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through |
| CVE-2026-53607 | 3.7 LOW | @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header |
| CVE-2026-45014 | Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in |
IV. 関連脆弱性
同じベンダー: apostrophecms
- CVE-2026-53609
Apostrophe has Server-Side Prototype Pollution in apos.util. - CVE-2026-53608
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized - CVE-2026-53607
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated - CVE-2026-53606
sanitize-html has an incomplete URI scheme validation that a - CVE-2026-45014
Apostrophe Vulnerable to Stored Cross-Site Scripting via Uns
同じ弱点: CWE-78
- CVE-2026-9863
Core Privileged Access Manager (BoKS) upgrade tooling comman - CVE-2026-9862
Core Privileged Access Manager (BoKS) autoregistration servi - CVE-2026-11527
Config::IniFiles versions before 3.001000 for Perl allow OS - CVE-2026-11526
GD versions before 2.86 for Perl allow OS command injection - CVE-2026-46716
Nezha Monitoring: RoleMember can run shell on every server (
V. CVE-2026-42853へのコメント
まだコメントはありません