CVE-2026-112958 apostrophecms CVE debrief

Who should care

Defenders managing ApostropheCMS installations, particularly those with custom widget styles or untrusted editors, should assess exposure and apply patches. They must verify exposure by checking ApostropheCMS versions and custom widget configurations. Successful exploitation allows attackers to inject malicious HTML event-handler attributes, potentially leading to unauthorized actions. Defenders should prioritize patching to prevent exploitation and review

Why it matters

The ApostropheCMS stored XSS vulnerability allows attackers to inject malicious HTML event-handler attributes, potentially leading to unauthorized actions. Defenders should prioritize verifying exposure, applying patches, and implementing additional security measures.

• Defenders must verify exposure by checking ApostropheCMS versions and custom widget configurations.
• Successful exploitation allows attackers to inject malicious HTML event-handler attributes, potentially leading to unauthorized actions.
• Defenders should prioritize patching to prevent exploitation.
• Additional security measures, such as output encoding, may be necessary for comprehensive protection.

Technical summary

The vulnerability occurs because free-form string style values in ApostropheCMS retain HTML metacharacters. The standard string field converter uses launder.string() and length validation, performing type normalization but not output encoding for an HTML attribute context. This oversight allows an attacker who can edit a widget to inject malicious HTML event-handler attributes by including a double quote in the style value, terminating the style attribute. The payload executes in the Apostrophe site origin when the affected published page is rendered.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, focusing on roles managing ApostropheCMS widgets and published pages.

Recommended defensive actions

• Verify exposure by checking if the ApostropheCMS version is prior to 4.34.0 and if widgets with custom style fields are used.
• Apply patches by updating to ApostropheCMS version 4.34.0 or later.
• Restrict widget editing to trusted roles and monitor published page changes.
• Implement additional security measures, such as output encoding for HTML attributes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability arises from ApostropheCMS widget styles supporting project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration without HTML-attribute escaping.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.