CVE-2026-112958
Received Received - Intake

ApostropheCMS Style Attribute Injection via Widget Field

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered. This issue is fixed in version 4.34.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112958
EUVD
EUVD-2026-105171

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apostrophecms apostrophe < 4.34.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS versions before 4.34.0 have a stored XSS flaw where a free-form widget style field can inject malicious JavaScript by including a double quote in the style value. This terminates the style attribute and adds executable HTML event-handler attributes like onfocus, which run when the page renders. The issue stems from unescaped HTML metacharacters in style values and lack of validation for inline CSS generation.

Detection Guidance

To detect this vulnerability, inspect ApostropheCMS instances running versions prior to 4.34.0 for free-form style fields containing unescaped quotes or event-handler attributes like onfocus. Check rendered HTML output for injected JavaScript in style attributes.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript when a user views affected published content or drafts. This may lead to privilege escalation, persistent content manipulation, phishing attacks, or unauthorized data access. The payload persists in the widget and triggers automatically for any viewer.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized data access or manipulation, and HIPAA by compromising protected health information through persistent XSS attacks. Compliance may be impacted if user data is exposed or altered due to the flaw.

Mitigation Strategies

Upgrade ApostropheCMS to version 4.34.0 or later immediately. Review and sanitize all free-form style fields to prevent quote injection. Implement input validation for inline CSS generation and ensure HTML escaping of attribute values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112958. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart