Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered. This issue is fixed in version 4.34.0.
Published: 2026-10-20
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting (XSS)
Action: Patch
AI Analysis

Impact

ApostropheCMS versions older than 4.34.0 allow a free‑form style field to carry an editor‑controlled quote into an inline style attribute because the serializer does not perform HTML‑attribute encoding. The embedded quote can terminate the attribute and introduce executable code when the content is rendered, leading to stored XSS that can affect both public pages and drafts viewed by higher‑privileged users.

Affected Systems

ApostropheCMS, open‑source Node.js content management system, is impacted when using any release prior to 4.34.0.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Attackers who can edit content or view drafts with elevated privileges can inject the malicious quote, achieving cross‑site scripting without needing additional conditions. The risk remains significant for sites where untrusted users have content‑editing rights.

Generated by OpenCVE AI on October 20, 2026 at 17:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ApostropheCMS to version 4.34.0 or later, which fixes the attribute‑encoding issue for widget style fields.
  • If an immediate upgrade is not feasible, modify the widget configuration to enforce HTML‑attribute escaping on the style field or disable the free‑form style field for non‑trusted editors.
  • Limit editing and draft‑view permissions to trusted accounts and consider sanitizing existing content that may contain unescaped style quotes.

Generated by OpenCVE AI on October 20, 2026 at 17:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-7jg5-frgc-c67w ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
History

Tue, 20 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Apostrophecms
Apostrophecms apostrophecms
Vendors & Products Apostrophecms
Apostrophecms apostrophecms

Tue, 20 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered. This issue is fixed in version 4.34.0.
Title ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Apostrophecms Apostrophecms
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-20T16:59:06.566Z

Reserved: 2026-10-19T21:30:47.246Z

Link: CVE-2026-112958

cve-icon Vulnrichment

Updated: 2026-10-20T16:58:25.295Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T17:17:33.190

Modified: 2026-10-20T19:53:10.247

Link: CVE-2026-112958

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T20:15:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')