PT-2026-49006

ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, apos.util.set traverses dot-notation paths without sanitizing proto , allowing an authenticated editor to write arbitrary values to Object.prototype via the $pullAll patch operator. A...