GHSA-M2M5-RW3W-CWMJ ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

Summary The client-side helper apos.http.parseQuery in ApostropheCMS builds a nested object from a URL query string without sanitizing the keys proto, constructor, or prototype. Parsing an attacker-controlled query string therefore writes arbitrary properties onto Object.prototype client-side...

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

Summary The client-side helper apos.http.parseQuery in ApostropheCMS builds a nested object from a URL query string without sanitizing the keys proto, constructor, or prototype. Parsing an attacker-controlled query string therefore writes arbitrary properties onto Object.prototype client-side...

CVE-2026-113659

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the specia...

CVE-2026-113659

ApostropheCMS , an open-source Node.js content management system, is vulnerable to Client-side Prototype Pollution in the apos.http.parseQuery function prior to version 4.33.0 . An unauthenticated attacker can craft a link with a malicious query string that, when parsed by a victim, allows for br...

CVE-2026-113659 ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the specia...

EUVD-2026-105207

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the specia...

PT-2026-118508

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions 3.x and 4.0.0 through 4.32.2 Description A client-side prototype pollution issue exists in the apos.http.parseQuery function. The parser fails to sanitize the proto , constructor, and prototype keys when processing URL...