https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 13:44:22 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-113659 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim&#39;s session; anonymous visitors do not load the affected admin context. This issue is fixed in version 4.33.0.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim&#39;s session; anonymous visitors do not load the affected admin context. This issue is fixed in version 4.33.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-113659 https://db.gcve.eu/vuln/ghsa-m2m5-rw3w-cwmj <p><strong>Affected:</strong> npm: apostrophe</p> <p>## Summary</p> <p>The client-side helper `apos.http.parseQuery()` in ApostropheCMS builds a nested object from a URL query string without sanitizing the keys `__proto__`, `constructor`, or `prototype`. Parsing an attacker-controlled query string therefore writes arbitrary properties onto `Object.prototype` (client-side prototype pollution).</p> <p>ApostropheCMS&#39;s admin UI calls this parser with `window.location.search` on **every authenticated page load** (the admin context bar&#39;s `data()` initializer). Because the admin UI is built on Vue, a polluted, enumerable property on `Object.prototype` is then picked up by Vue&#39;s standard element-mount routine and written to the DOM as an element property, turning the prototype pollution into DOM-based XSS in the victim&#39;s authenticated session. The escalation gadget is a well-known, general Vue behavior; the novel, reportable defect is the unsanitized `parseQuery` source together with the authenticated trigger, both of which are ApostropheCMS code.</p> <p>Any user who can get **any logged-in user (from the lowest-privileged `guest` role up to the highest-privileged `admin` role)** to open a crafted URL can execute arbitrary JavaScript in that user&#39;s session.</p> <p>This is **distinct from CVE-2026-53609** (server-side prototype pollution via `apos.util.set()` / `$pullAll`, fixed in 4.31.0): different side (client vs server), different code path, and the vulnerable code here is present in the current release.</p> <p>## Package</p> <p>- **Ecosystem:** npm - **Package:** `a…</p> <p><strong>Affected:</strong> npm: apostrophe</p> <p>## Summary</p> <p>The client-side helper `apos.http.parseQuery()` in ApostropheCMS builds a nested object from a URL query string without sanitizing the keys `__proto__`, `constructor`, or `prototype`. Parsing an attacker-controlled query string therefore writes arbitrary properties onto `Object.prototype` (client-side prototype pollution).</p> <p>ApostropheCMS&#39;s admin UI calls this parser with `window.location.search` on **every authenticated page load** (the admin context bar&#39;s `data()` initializer). Because the admin UI is built on Vue, a polluted, enumerable property on `Object.prototype` is then picked up by Vue&#39;s standard element-mount routine and written to the DOM as an element property, turning the prototype pollution into DOM-based XSS in the victim&#39;s authenticated session. The escalation gadget is a well-known, general Vue behavior; the novel, reportable defect is the unsanitized `parseQuery` source together with the authenticated trigger, both of which are ApostropheCMS code.</p> <p>Any user who can get **any logged-in user (from the lowest-privileged `guest` role up to the highest-privileged `admin` role)** to open a crafted URL can execute arbitrary JavaScript in that user&#39;s session.</p> <p>This is **distinct from CVE-2026-53609** (server-side prototype pollution via `apos.util.set()` / `$pullAll`, fixed in 4.31.0): different side (client vs server), different code path, and the vulnerable code here is present in the current release.</p> <p>## Package</p> <p>- **Ecosystem:** npm - **Package:** `a…</p> https://db.gcve.eu/vuln/ghsa-m2m5-rw3w-cwmj