TI-2026-27673 Aliases CVE-2026-35569 GHSA-855c-r2vq-c292

ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS

HIGH 73CWE-116Published 2026-04-15 · Updated 2026-05-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts including <title> tags, <meta> attributes, and JSON-LD structured data. An attacker can inject a payload such as "></title><script>alert(1)</script> to break out of the intended HTML context and execute arbitrary JavaScript in the browser of any authenticated user who views the affected page. This can be leveraged to perform authenticated API requests, access sensitive data such as usernames, email addresses, and roles via internal APIs, and exfiltrate it to an attacker-controlled server. This issue has been fixed in version 4.29.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00298 22nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed apostrophe (apostrophecms): 4.29.0apostrophe (npm): 4.29.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
apostrophecms	apostrophe	before 4.29.0	4.29.0	Patch available	CNA
—	apostrophe (npm)	before 4.29.0	4.29.0	Patch available	GHSA-855c-r2vq-c292

apostrophe Vendorapostrophecms Affected before 4.29.0 Fixed in 4.29.0 Patch available CNA
apostrophe (npm) Vendor— Affected before 4.29.0 Fixed in 4.29.0 Patch available GHSA-855c-r2vq-c292

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apostrophecms:apostrophecms::::::::	before 4.29.0	Vulnerable	apostrophecms

cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* Versions before 4.29.0 Vulnerable ·apostrophecms

Remediation

Fix · CNA apostrophe (apostrophecms) Fixed in 4.29.0
Fix · GHSA-855c-r2vq-c292 apostrophe (npm) Fixed in 4.29.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-35569
2026-10-03 Alias added: GHSA-855c-r2vq-c292

References

Other 2

TI-2026-25222 ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware CVSS 3.1HIGH 8.1
TI-2026-28738 Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions CVSS 3.1MEDIUM 5.3
TI-2026-26246 ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API CVSS 3.1MEDIUM 5.3
TI-2026-29000 ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements CVSS 3.1MEDIUM 6.1
TI-2026-26247 ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context CVSS 3.1MEDIUM 5.4
TI-2026-26237 ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint CVSS 3.1LOW 3.7

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences