Prototype Pollution in ApostropheCMS Affects Node.js Platform

CVE-2026-113659

What is CVE-2026-113659?

ApostropheCMS, an open-source Node.js content management system, is susceptible to prototype pollution vulnerabilities in versions before 4.33.0. An unauthenticated attacker can exploit this by sending specially crafted links that the 'apos.http.parseQuery' function processes when an authenticated user accesses a page with the admin bundle. This function improperly handles special keys, including proto, constructor, and prototype, allowing for the malicious alteration of object prototypes. This can lead to unsafe DOM manipulations and potential script execution in the context of the vulnerable user's session. It's crucial for users of ApostropheCMS to update to the latest version, 4.33.0, where this security issue has been resolved.

References