Read the docs
TI-2026-26247 Aliases CVE-2026-33889GHSA-97v6-998m-fp4g

ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context

Priority MEDIUM 58CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module, where color values prefixed with -- bypass TinyColor validation intended for CSS custom properties, and the launder.string() call performs only type coercion without stripping HTML metacharacters. These unsanitized values are then concatenated directly into <style> tags both in per-widget style elements rendered for all visitors and in the global stylesheet rendered for editors, with the output marked as safe HTML. An editor can inject a value which closes the style tag and executes arbitrary JavaScript in the browser of every visitor to any page containing the affected widget. This enables mass session hijacking, cookie theft, and privilege escalation to administrative control if an admin views draft content. This issue has been fixed in version 4.29.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00222 12th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed apostrophe (apostrophecms): 4.29.0apostrophe (npm): 4.29.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
apostrophecmsapostrophebefore 4.29.04.29.0Patch availableCNA
—apostrophe (npm)before 4.29.04.29.0Patch availableGHSA-97v6-998m-fp4g
  • apostrophe Vendorapostrophecms Affected before 4.29.0 Fixed in 4.29.0 Patch available CNA
  • apostrophe (npm) Vendor— Affected before 4.29.0 Fixed in 4.29.0 Patch available GHSA-97v6-998m-fp4g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*before 4.29.0Vulnerableapostrophecms
  • cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* Versions before 4.29.0 Vulnerable ·apostrophecms

Remediation

  • Fix · CNA apostrophe (apostrophecms) Fixed in 4.29.0
  • Fix · GHSA-97v6-998m-fp4g apostrophe (npm) Fixed in 4.29.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33889
  2. 2026-10-03 Alias added: GHSA-97v6-998m-fp4g

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
  • TI-2026-25222 ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware CVSS 3.1HIGH 8.1
  • TI-2026-28738 Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions CVSS 3.1MEDIUM 5.3
  • TI-2026-26246 ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API CVSS 3.1MEDIUM 5.3
  • TI-2026-29000 ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements CVSS 3.1MEDIUM 6.1
  • TI-2026-26237 ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint CVSS 3.1LOW 3.7
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences