Apostrophe - XSS
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00499 43rd percentileScored 2026-11-07
Fix Fixed apostrophe (npm): 3.4.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apostrophe | Apostrophe | up to 3.3.1; 2.63.0 and later | — | No fix listed | CNA |
| — | apostrophe (npm) | 2.63.0 to before 3.4.0 | 3.4.0 | Patch available | GHSA-4r9c-jghc-cx5m |
- Apostrophe VendorApostrophe Affected up to 3.3.1; 2.63.0 and later Fixed in — No fix listed CNA
- apostrophe (npm) Vendor— Affected 2.63.0 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-4r9c-jghc-cx5m
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* | 2.63.0 – 3.3.1 | Vulnerable | apostrophecms |
- cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* Versions 2.63.0 – 3.3.1 Vulnerable ·apostrophecms
Remediation
- Fix · GHSA-4r9c-jghc-cx5m apostrophe (npm) Fixed in 3.4.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25978
- 2026-10-03 Alias added: GHSA-4r9c-jghc-cx5m
References
More Apostrophecms vulnerabilities
- TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
- TI-2026-25222 ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware CVSS 3.1HIGH 8.1
- TI-2026-28738 Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions CVSS 3.1MEDIUM 5.3
- TI-2026-26246 ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API CVSS 3.1MEDIUM 5.3
- TI-2026-29000 ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements CVSS 3.1MEDIUM 6.1
- TI-2026-26247 ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context CVSS 3.1MEDIUM 5.4
Sources
- CVE-2021-25978 · CVE Program
- CVE-2021-25978 · NVD
- FIRST EPSS
- GHSA-4r9c-jghc-cx5m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences