Stored Cross-Site Scripting Vulnerability in ApostropheCMS by Apostrophe
CVE-2026-33889

5.4MEDIUM

Key Information:

Vendor

Apostrophecms

Status
Apostrophe
Vendor
CVE Published:
15 April 2026

What is CVE-2026-33889?

ApostropheCMS, an open-source Node.js content management system, suffers from a stored cross-site scripting vulnerability in the @apostrophecms/color-field module. The flaw arises when color values prefixed with '--' bypass the TinyColor validation designed for CSS custom properties. Unsanitized color values can then be inserted directly into tags across various rendered pages, exposing all visitors to the risk of malicious script execution. This vulnerability could allow an attacker to hijack sessions, steal cookies, and potentially escalate privileges, particularly if administrators access affected draft content. The issue has been addressed in version 4.29.0.

Affected Version(s)

apostrophe < 4.29.0

References

https://github.com/apostrophecms/apostrophe/security/advi...
x_refsource_CONFIRM
https://github.com/apostrophecms/apostrophe/commit/6a89bd...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.