Injection Vulnerability in ApostropheCMS Affecting Node.js Users
CVE-2026-112958

5.4MEDIUM

Key Information:

Vendor: Apostrophecms
Status: Apostrophe
Vendor: CVE Published:; 20 October 2026

🔔 Create Apostrophecms Vulnerability Alert

What is CVE-2026-112958?

ApostropheCMS, an open-source Node.js content management system, has a vulnerability stemming from improper HTML-attribute encoding in project-defined free-form widget style fields. This can lead to an editor-controlled quote terminating the style attribute, allowing for the injection of executable attributes. This issue affects published content and drafts viewed by higher-privileged users, raising significant security concerns. The vulnerability has been addressed in version 4.34.0.