CVE-2026-112951 apostrophecms CVE debrief

Who should care

Authenticated users with edit rights in ApostropheCMS, as well as administrators and developers responsible for maintaining and securing the CMS. These individuals should be aware of the potential for stored XSS and take steps to mitigate the vulnerability. This includes reviewing and updating ApostropheCMS, restricting edit rights, and monitoring for potential XSS attacks. Additionally, security teams and vulnerability management teams should be aware of

Why it matters

Authenticated users with edit rights can store arbitrary HTML after a valid color prefix, resulting in stored XSS when rendered, which can lead to unauthorized actions, compromise of user sessions, defacement of content, and potential lateral movement within the CMS.

• Stored XSS can lead to unauthorized actions on behalf of authenticated users
• Compromise of user sessions or accounts
• Defacement or modification of content
• Potential for lateral movement within the CMS

Technical summary

The color field in ApostropheCMS accepts any string that begins with a valid rgb() / hsl() color, allowing for arbitrary HTML to be stored and executed as XSS. The root cause is TinyColor's rgb/hsl matchers not being anchored at the end of the string. This issue allows for unauthorized actions, compromise of user sessions, defacement of content, and potential lateral movement within the CMS. The value is saved to MongoDB unchanged (not normalized to hex8). Supplied source corpus provides limited evidence; further verification is needed.

Defensive priority

Authenticated users with edit rights can store arbitrary HTML after a valid color prefix, resulting in stored XSS when rendered.

Recommended defensive actions

• Review and update ApostropheCMS to version 4.34.0 or later
• Restrict edit rights to authenticated users
• Monitor for and respond to potential XSS attacks
• Implement additional security measures such as Content Security Policy (CSP)
• Conduct regular security audits and penetration testing
• Review and update TinyColor to a version that anchors its match at the end of the string
• Consider using a different color validation library

Evidence notes

The color field validation relies on TinyColor, which does not anchor its match at the end of the string, allowing for arbitrary HTML to be stored and executed as XSS. Tested with @ctrl/tinycolor: rgb(1,2,3)<img src=x onerror=alert(1)> is valid. The value is saved to MongoDB unchanged (not normalized to hex8). This issue allows for unauthorized actions, compromise of user sessions, defacement of content, and potential lateral movement within the CMS. Evidence is limited to supplied source corpus and defensive verification tasks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.