PatchSiren cyber security CVE debrief

CVE-2026-42853 apostrophecms CVE debrief

ApostropheCMS's @apostrophecms/cli package, up to and including version 3.6.0, contains a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping, allowing execution of arbitrary commands on the host system. As of publication, no patched versions are available.

Vendor: apostrophecms
Product: @apostrophecms/cli
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-12
Original CVE updated: 2026-06-13
Advisory published: 2026-06-12
Advisory updated: 2026-06-13

Who should care

Users of ApostropheCMS's @apostrophecms/cli package, particularly those using versions up to and including 3.6.0, should be aware of this vulnerability and take necessary precautions.

Technical summary

The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. It requires local access, low attack complexity, high privileges, and user interaction. Successful exploitation can lead to high impact on confidentiality, integrity, and availability.

Defensive priority

MEDIUM

Recommended defensive actions

Users should exercise caution when using the apos create command and avoid providing unsanitized input.
Administrators should monitor their systems for suspicious activity and consider implementing additional security measures.
Users should check for updates to the @apostrophecms/cli package and upgrade to a patched version as soon as it becomes available.

Evidence notes

This vulnerability was reported via the National Vulnerability Database (NVD) and is tracked under CVE-2026-42853. More information can be found at [cve-org].

Official resources

CVE-2026-42853 was published on [cvePublishedAt] and last modified on [cveModifiedAt].