Arbitrary Object Prototype Manipulation in ApostropheCMS by ApostropheCMS

CVE-2026-53609

What is CVE-2026-53609?

ApostropheCMS, an open-source Node.js content management system, suffers from a significant security flaw in versions up to and including 4.30.0. The vulnerability arises from the apos.util.set() method, which fails to sanitize the __proto__ property when traversing dot-notation paths. As a result, an authenticated user can exploit this flaw to inject arbitrary values into Object.prototype using the $pullAll patch operator. The consequence of this manipulation is far-reaching, as it allows unauthorized access to all piece-type REST API endpoints for every subsequent unauthenticated request during the lifetime of the Node.js process. As of the current reporting, there are no known patched versions available to address this vulnerability.

References