CVE-2026-113659 in ApostropheCMS
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session; anonymous visitors do not load the affected admin context. This issue is fixed in version 4.33.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
ApostropheCMS represents a widely utilized open-source content management system built on the Node.js platform, designed to facilitate flexible website creation and maintenance. Within this ecosystem, the administrative interface serves as a critical component for site managers and developers, providing access to sensitive configuration options and data manipulation tools. The security integrity of this admin bundle is paramount, as compromise can lead to significant operational disruptions or unauthorized control over digital assets. Prior to version 4.33.0, a specific architectural flaw existed within the client-side JavaScript logic that handled URL query string parsing, creating an avenue for sophisticated cross-site scripting attacks targeting authenticated administrators.
The core technical vulnerability stems from how the apos.http.parseQuery function processes incoming data. This utility is designed to parse query strings into usable objects but fails to adequately sanitize or restrict special property names during the construction of JavaScript objects. Specifically, it accepts keys such as _proto_, constructor, and prototype without sufficient validation. In modern JavaScript environments, these properties are intrinsic to the Object.prototype chain. When an attacker crafts a malicious link containing these specific query parameters, the parser inadvertently injects them into the object being constructed in memory. This behavior triggers browser prototype mutation, effectively altering the base structure of objects within that execution context rather than simply adding data fields.
This mechanism facilitates a form of client-side prototype pollution which can escalate to severe consequences when combined with unsafe DOM sinks. Once the prototype is polluted, subsequent code operations that rely on standard object properties may inherit these malicious values or behaviors. In the specific case of ApostropheCMS prior to 4.33.0, this mutation allows an attacker to inject script execution capabilities into the victim's session. The attack vector relies on social engineering, requiring an authenticated administrator with access to the admin bundle to load a page containing the crafted link. It is important to note that anonymous visitors do not trigger this vulnerability because they do not load the affected administrative context where the vulnerable parsing logic and subsequent DOM interactions occur.
The operational impact of this vulnerability is significant for organizations relying on ApostropheCMS for their digital presence. Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript code within the security context of an authenticated administrator. This can lead to session hijacking, theft of sensitive content management credentials, defacement of the website by manipulating DOM elements, or further pivoting into backend systems if other vulnerabilities are present in conjunction with this initial access. The ability to mutate prototypes means that the attack is not limited to a single instance but can affect multiple objects and functions within the application's runtime environment, amplifying the blast radius of the exploit.
From a classification perspective, this vulnerability aligns closely with CWE-1321: Improperly Controlled Modification of Object Prototype Attributes, commonly known as JavaScript prototype pollution. Furthermore, in terms of adversary tactics, it maps to MITRE ATT&CK techniques related to Client-Side Scripting and potentially Command and Control if used for beaconing or data exfiltration through the compromised admin session. The lack of input validation on critical object keys represents a fundamental failure in secure coding practices regarding dynamic property assignment.
Mitigation strategies primarily involve upgrading to version 4.33.0 or later, where this parsing logic has been corrected to prevent prototype pollution. For organizations unable to immediately upgrade, implementing strict Content Security Policy headers can help mitigate the impact by restricting script execution sources and preventing inline scripts from running even if injected into the DOM. Additionally, developers should ensure that any custom code utilizing query string parsers implements explicit checks for dangerous property names like _proto_ or constructor before allowing them to be assigned as object keys. Regular security audits of third-party dependencies and client-side libraries are essential to maintain a robust defense posture against such subtle but impactful vulnerabilities.