https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 14:42:23 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-112958 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered. This issue is fixed in version 4.34.0.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered. This issue is fixed in version 4.34.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-112958 https://db.gcve.eu/vuln/ghsa-7jg5-frgc-c67w <p><strong>Affected:</strong> npm: apostrophe</p> <p>## Summary</p> <p>ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form `string` style field with a CSS `property` and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget wrapper&#39;s `style=&#34;...&#34;` attribute without HTML-attribute escaping.</p> <p>An attacker who can edit the widget can include a double quote in the style value, terminate the `style` attribute, and inject new HTML event-handler attributes. The payload is stored with the widget and executes in the Apostrophe site origin whenever the affected published page is rendered.</p> <p>This is a sibling of CVE-2026-33889 / `GHSA-97v6-998m-fp4g`. The earlier issue escaped from a `&lt;style&gt;` element through a malicious color value. This variant reaches a different sink related to the automatically generated widget wrapper&#39;s inline `style` and `class` attributes.</p> <p>## Details</p> <p>### Root Cause 1: Free-form string style values retain HTML metacharacters</p> <p>The standard string field converter uses `launder.string()` and length validation. This performs type normalization, not output encoding for an HTML attribute context:</p> <p>[`packages/apostrophe/modules/@apostrophecms/schema/lib/addFieldTypes.js:296-333`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/schema/lib/addFieldTypes.js#L296-L333)</p> <p>```javascript self.addFieldType({ name: &#39;…</p> <p><strong>Affected:</strong> npm: apostrophe</p> <p>## Summary</p> <p>ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form `string` style field with a CSS `property` and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget wrapper&#39;s `style=&#34;...&#34;` attribute without HTML-attribute escaping.</p> <p>An attacker who can edit the widget can include a double quote in the style value, terminate the `style` attribute, and inject new HTML event-handler attributes. The payload is stored with the widget and executes in the Apostrophe site origin whenever the affected published page is rendered.</p> <p>This is a sibling of CVE-2026-33889 / `GHSA-97v6-998m-fp4g`. The earlier issue escaped from a `&lt;style&gt;` element through a malicious color value. This variant reaches a different sink related to the automatically generated widget wrapper&#39;s inline `style` and `class` attributes.</p> <p>## Details</p> <p>### Root Cause 1: Free-form string style values retain HTML metacharacters</p> <p>The standard string field converter uses `launder.string()` and length validation. This performs type normalization, not output encoding for an HTML attribute context:</p> <p>[`packages/apostrophe/modules/@apostrophecms/schema/lib/addFieldTypes.js:296-333`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/schema/lib/addFieldTypes.js#L296-L333)</p> <p>```javascript self.addFieldType({ name: &#39;…</p> https://db.gcve.eu/vuln/ghsa-7jg5-frgc-c67w