ApostropheCMS versions before 4.33.0 parse query strings on the client side with the function apos.http.parseQuery, which accepts the special keys __proto__, constructor, and prototype. An attacker can craft a link whose query string includes these keys, causing browser prototype mutation that propagates to an unsafe DOM sink and executes arbitrary JavaScript within the victim’s authenticated session. Only users who load the admin bundle are affected, so anonymous visitors do not load the vulnerable code path.

ApostropheCMS, the open‑source Node.js content management system developed by apostrophecms, is affected on all releases prior to version 4.33.0. The vulnerability applies to the client‑side query parsing logic in the admin interface of those releases.

The CVSS score of 6.1 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious link containing a crafted query string that an authenticated user follows while the admin bundle is loaded; an attacker may need internal or compromised access to deliver the link. Because the vulnerability requires an authenticated session to load the affected code, the threat surface is reduced, but the risk of exploitation in an internal or compromised environment remains moderate.