@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input
CVE-2026-42853

6.5MEDIUM

Key Information:

Vendor

Apostrophecms

Status
@apostrophecms/cli
Vendor
CVE Published:
12 June 2026

What is CVE-2026-42853?

ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system. As of time of publication, no known patched versions are available.

Affected Version(s)

@apostrophecms/cli <= 3.6.0

References

https://github.com/apostrophecms/apostrophe/security/advi...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.