CVE-2026-45014

Deferred Deferred - Pending Action

Stored XSS in ApostropheCMS via Draft Tooltip

Publication date: 2026-06-12

Last updated on: 2026-06-15

Assigner: GitHub, Inc.

Description

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsanitized user display name in draft version tooltip. As of time of publication, no known patched versions are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-15

Generated

2026-07-03

AI Q&A

2026-06-13

EPSS Evaluated

2026-07-01

NVD

CVE-2026-45014

Affected Vendors & Products

Vendor	Product	Version / Range
apostrophecms	apostrophe	to 4.29.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects ApostropheCMS, an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting (XSS). The issue arises because the user display name is not properly sanitized when shown in the draft version tooltip, allowing malicious scripts to be stored and executed.

Impact Analysis

The stored cross-site scripting vulnerability can allow attackers to inject malicious scripts that execute in the context of users viewing the draft version tooltip. This can lead to unauthorized actions, data theft, session hijacking, or other malicious activities performed on behalf of the victim user.

Mitigation Strategies

As of the time of publication, no known patched versions of ApostropheCMS are available to fix this vulnerability.

Immediate mitigation steps should include avoiding the use of unsanitized user display names in draft version tooltips and implementing manual input sanitization or filtering to prevent stored cross-site scripting.

Additionally, consider restricting or monitoring user input that appears in tooltips and applying web application firewall (WAF) rules to detect and block potential XSS payloads.

Hi! I’m here to help you understand CVE-2026-45014. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70