CVE-2026-112951 in ApostropheCMS
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb() or hsl() prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered, the payload executes, resulting in stored XSS. This issue is fixed in version 4.34.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
ApostropheCMS is an open-source content management system built on Node.js that allows users to create and manage digital content through a web interface. The vulnerability identified involves the color field within its editing components, which relies on TinyColor for input validation prior to version 4.34.0. This library is commonly used in JavaScript applications to parse and manipulate colors but contains specific parsing behaviors that can be exploited if not strictly constrained by the host application logic. In this instance, the validation mechanism implemented in ApostropheCMS failed to enforce strict boundary checking on color inputs, allowing for a significant security flaw known as stored cross-site scripting or XSS.
The technical root cause of this vulnerability lies in how the TinyColor library processes input strings containing rgb() or hsl() prefixes. The parser is designed to be permissive, extracting valid color data from the beginning of a string while ignoring any trailing content that does not conform to standard color syntax rules. Because ApostropheCMS did not implement additional validation to ensure that the entire user-supplied value matched a strict color format, it accepted inputs where malicious payloads were appended after legitimate color definitions. This design oversight means that an attacker could craft a specially formatted string that satisfies the initial regex or parsing check for a valid color but contains executable JavaScript code in the non-color portion of the input.
An authenticated user with edit rights can exploit this flaw by storing arbitrary HTML and script tags within fields that utilize the vulnerable color picker component. When such content is saved, it persists on the server side without immediate sanitization or execution context restriction at the point of storage. The critical impact occurs when another user views a page containing this stored payload. As the browser renders the page, it interprets the embedded script tags as executable code rather than plain text data. This results in the automatic execution of arbitrary JavaScript within the victim's session context, effectively bypassing same-origin policy protections and allowing the attacker to perform actions on behalf of the user or access sensitive information such as cookies, session tokens, or personal data stored locally by the browser.
This vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents a case where input validation is insufficient to prevent malicious code injection due to loose parsing rules in underlying libraries. From an ATT&CK perspective, this aligns with techniques involving Stored XSS for initial access or persistence, and potentially credential theft if the script exfiltrates session cookies. The attack vector requires authentication, which limits its scope compared to reflected XSS but increases the severity because the payload is permanently stored and served to multiple victims over time without further interaction from the attacker after the initial injection.
Mitigation strategies primarily involve upgrading ApostropheCMS to version 4.34.0 or later, where this validation logic has been corrected to enforce strict matching of color values. For organizations unable to upgrade immediately, implementing a Web Application Firewall rule that detects and blocks script tags within fields expected to contain only color codes can provide temporary protection. Additionally, developers should ensure that all third-party libraries used for input parsing are configured with the most restrictive settings available and that application-level validation enforces strict type checking on all user inputs before they are persisted in the database or rendered back into HTML contexts without proper encoding.