CVE-2026-112958: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered. This issue is fixed in version 4.34.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMSto a version that resolves this vulnerability.Fixed in 4.34.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An editor who can control the value of a project-defined free-form widget style field can supply a quote that escapes the inline style attribute and injects executable attributes.
When does the injected content execute?
It can execute when published content is rendered. It can also execute if an affected draft is rendered for a higher-privileged user.
Are default ApostropheCMS installations affected?
The issue requires a project-defined free-form widget style field. The provided information does not establish that such a field is present in a default configuration.
What version resolves the issue?
Upgrade ApostropheCMS to version 4.34.0 or later. Versions prior to 4.34.0 are affected.