CVE-2026-113659
Received Received - Intake

Stored XSS in ApostropheCMS via Prototype Pollution

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session; anonymous visitors do not load the affected admin context. This issue is fixed in version 4.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113659
EUVD
EUVD-2026-105207

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a client-side Prototype Pollution vulnerability in ApostropheCMS's apos.http.parseQuery() function that leads to DOM-based Cross-Site Scripting (XSS) for authenticated users. The function does not sanitize keys like __proto__, constructor, or prototype when parsing URL query strings, allowing attackers to inject malicious properties into Object.prototype. This pollution is then exploited in the admin UI, which uses Vue.js, where Vue's element-mount routine picks up the polluted property and writes it to the DOM, executing arbitrary JavaScript in the victim's authenticated session.

Detection Guidance

Detecting this vulnerability requires checking the ApostropheCMS version and monitoring for unusual admin UI behavior. Verify if your system runs versions 4.0.0 to 4.32.2 or 3.x affected versions. Inspect network traffic for crafted URLs containing __proto__, constructor, or prototype in query strings targeting authenticated users.

Impact Analysis

An attacker can trick an authenticated user into clicking a crafted link, which executes arbitrary JavaScript in the victim's authenticated session. This could allow the attacker to perform actions on behalf of the user, steal session cookies, or access sensitive data within the admin interface. The attack requires user interaction but is exploitable by any authenticated user, from guest to admin roles.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected versions of ApostropheCMS may face compliance risks due to potential data breaches or unauthorized data exposure.

Mitigation Strategies

Immediately upgrade ApostropheCMS to version 4.33.0 or later. As a temporary measure, instruct users to avoid clicking untrusted links while logged into the admin interface. Review and sanitize URL query parameters in the application to block dangerous keys like __proto__.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113659. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart