CVE-2026-53609

ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, "apos.util.set" traverses dot-notation paths without sanitizing "proto", allowing an authenticated editor to write arbitrary values to "Object.prototype" via the "$pullAll" patch operator. A...

CVE-2026-53609: Improperly Controlled Modification of Object Prototype Attributes

ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, apos.util.set traverses dot-notation paths without sanitizing proto, allowing an authenticated editor to write arbitrary values to Object.prototype via the $pullAll patch operator. A confirm...