ApostropheCMS: Color Field Validation Bypass Allows Stored XSS Via HTML Appended After Rgb()/hsl() Prefix

Summary The color field accepts any string that begins with a valid "rgb" / "hsl" color, because "TinyColor.isValid" does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered ,...