PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45014 apostrophecms CVE debrief

ApostropheCMS, an open-source Node.js content management system, is vulnerable to stored cross-site scripting (XSS) via an unsanitized user display name in the draft version tooltip. This vulnerability is identified as CVE-2026-45014 and has a CVSS score of 5.3, categorized as MEDIUM severity. As of the publication date, no patched versions are available. The vulnerability allows an attacker to inject malicious scripts into the display name field, which can then be executed when another user views the draft version tooltip.

Vendor
apostrophecms
Product
apostrophe
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-15
Advisory published
2026-06-12
Advisory updated
2026-06-15

Who should care

Developers and administrators using ApostropheCMS versions up to and including 4.29.0 should be aware of this vulnerability and take necessary precautions to mitigate the risk.

Technical summary

The vulnerability exists due to improper sanitization of user input in the display name field. An attacker can inject malicious scripts, which can then be stored and executed when another user views the draft version tooltip. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update to a patched version of ApostropheCMS as soon as it becomes available.
  • Implement additional security measures to validate and sanitize user input.
  • Monitor for suspicious activity and implement Content Security Policy (CSP) to mitigate XSS attacks.

Evidence notes

This vulnerability is confirmed by the CVE record [cve-org]. Additional information can be found in the NVD detail [nvd] and the source reference [ref-4].

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45014 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45014

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45014 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45014

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.