PatchSiren cyber security CVE debrief

CVE-2026-45014 apostrophecms CVE debrief

ApostropheCMS, an open-source Node.js content management system, is vulnerable to stored cross-site scripting (XSS) via an unsanitized user display name in the draft version tooltip. This vulnerability is identified as CVE-2026-45014 and has a CVSS score of 5.3, categorized as MEDIUM severity. As of the publication date, no patched versions are available. The vulnerability allows an attacker to inject malicious scripts into the display name field, which can then be executed when another user views the draft version tooltip.

Vendor: apostrophecms
Product: apostrophe
CVSS: MEDIUM 5.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-12
Original CVE updated: 2026-06-12
Advisory published: 2026-06-12
Advisory updated: 2026-06-12

Who should care

Developers and administrators using ApostropheCMS versions up to and including 4.29.0 should be aware of this vulnerability and take necessary precautions to mitigate the risk.

Technical summary

The vulnerability exists due to improper sanitization of user input in the display name field. An attacker can inject malicious scripts, which can then be stored and executed when another user views the draft version tooltip. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

MEDIUM

Recommended defensive actions

Update to a patched version of ApostropheCMS as soon as it becomes available.
Implement additional security measures to validate and sanitize user input.
Monitor for suspicious activity and implement Content Security Policy (CSP) to mitigate XSS attacks.

Evidence notes

This vulnerability is confirmed by the CVE record [cve-org]. Additional information can be found in the NVD detail [nvd] and the source reference [ref-4].

Official resources

CVE-2026-45014 was published on 2026-06-12T21:16:22.990Z and has not been modified since then.