CVE-2026-112951: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in apostrophecms apostrophe

ApostropheCMS, an open-source Node.js content management system, has a stored XSS vulnerability (CWE-79) in versions before 4.34.0. The color field validation uses TinyColor but does not enforce that the entire input matches a valid color format, permitting trailing content after a valid rgb() or hsl() prefix. An authenticated user with edit permissions can exploit this by injecting arbitrary HTML, which executes when the stored value is rendered. The issue is resolved in version 4.34.0.

An authenticated user with edit rights can inject and store arbitrary HTML content via the color field, leading to stored cross-site scripting. This can result in the execution of malicious scripts in the context of users viewing the affected content, potentially compromising confidentiality and integrity of user sessions or data. The CVSS score is 5.4 (medium severity), indicating a moderate impact with low attack complexity but requiring user interaction and privileges.

Upgrade ApostropheCMS to version 4.34.0 or later, where this vulnerability is fixed. No other mitigation is specified or required as the fix addresses the root cause in input validation.