CVE-2026-53609— Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
Possible ATT&CK Techniques 3AI
T1528 · Steal Application Access Token T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| apostrophecms | apostrophe | <= 4.30.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-53609
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
Source: NVD (National Vulnerability Database)
Vulnerability Description
ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process. As of time of publication, no known patched versions are available.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1321
Source: NVD (National Vulnerability Database)
Vulnerability Title
ApostropheCMS 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
apostrophecms是Apostrophecms公司开源的一个内容管理系统。 ApostropheCMS 4.30.0及之前版本存在输入验证错误漏洞，该漏洞源于`apos.util.set()`遍历点符号路径时未清理`__proto__`，允许经过身份验证的编辑器通过`$pullAll`补丁操作符向`Object.prototype`写入任意值，`publicApiCheck()`中的确认小工具导致对所有后续未经身份验证的请求绕过所有片段类型REST API端点的授权。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| apostrophecms | apostrophe | <= 4.30.0 | - |
II. Public POCs for CVE-2026-53609
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCVerified env Premium
Qwen3.6-35B-A3B · 9805 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-53609
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-53609 (1)
Same Patch Batch · apostrophecms · 2026-06-12 · 10 CVEs total
| CVE-2026-44990 | 9.3 CRITICAL | Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` |
| CVE-2026-53608 | 8.7 HIGH | @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Inje |
| CVE-2026-45013 | 8.1 HIGH | Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Inpu |
| CVE-2026-45012 | 7.6 HIGH | Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/valid |
| CVE-2026-45011 | 7.3 HIGH | Apostrophe has stored XSS via javascript: URL in Image Widget Link |
| CVE-2026-42853 | 6.5 MEDIUM | @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input |
| CVE-2026-53606 | 5.4 MEDIUM | sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through |
| CVE-2026-53607 | 3.7 LOW | @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header |
| CVE-2026-45014 | Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in |
IV. Related Vulnerabilities
Same product: apostrophe
- CVE-2026-53607
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated - CVE-2026-45014
Apostrophe Vulnerable to Stored Cross-Site Scripting via Uns - CVE-2026-45013
Apostrophe has a Weak Password Recovery Mechanism for Forgot - CVE-2026-45012
Apostrophe has authenticated SSRF in rich-text widget import - CVE-2026-45011
Apostrophe has stored XSS via javascript: URL in Image Widge
Same vendor: apostrophecms
- CVE-2026-53608
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized - CVE-2026-53607
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated - CVE-2026-53606
sanitize-html has an incomplete URI scheme validation that a - CVE-2026-45014
Apostrophe Vulnerable to Stored Cross-Site Scripting via Uns - CVE-2026-45013
Apostrophe has a Weak Password Recovery Mechanism for Forgot
Same weakness: CWE-1321
- CVE-2026-15702
tamagui config.ts updateConfig prototype pollution - CVE-2026-15699
spencermountain compromise Public Root API extend.js nlp.ext - CVE-2026-15698
kofrasa mingo Update API updateMany prototype pollution - CVE-2026-15697
svgdotjs svg.js npm Package API EventTarget.on prototype pol - CVE-2026-15607
tanstack db Alias Path select.ts select prototype pollution
V. Comments for CVE-2026-53609
No comments yet