CVE-2026-112951
Deferred Deferred - Pending Action

Stored XSS in ApostropheCMS via Color Field

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb() or hsl() prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered, the payload executes, resulting in stored XSS. This issue is fixed in version 4.34.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-112951
EUVD
EUVD-2026-105154

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apostrophecms apostrophe < 4.34.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS is a Node.js content management system. Prior to version 4.34.0, the color field incorrectly validates input by accepting trailing content after a valid rgb() or hsl() color prefix. This allows authenticated users with edit rights to inject arbitrary HTML after a valid color value. When rendered, this HTML executes as stored cross-site scripting (XSS).

Detection Guidance

Check ApostropheCMS version with npm list apostrophe or grep package.json. Inspect color field inputs for trailing HTML after rgb()/hsl() values. Review stored values in MongoDB for non-standard color formats.

Impact Analysis

An attacker could exploit this to execute malicious scripts in the context of a user's session. This could lead to session hijacking, unauthorized actions on behalf of the user, or theft of sensitive data. The impact depends on user privileges and the application's context.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations may face compliance penalties if user data is compromised due to this XSS flaw.

Mitigation Strategies

Upgrade ApostropheCMS to version 4.34.0 or later. Validate color fields to reject non-color content. Normalize stored color values to hex8 format on save. Restrict edit permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112951. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...