CVE-2026-113659: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in apostrophecms apostrophe

ApostropheCMS, an open-source Node.js CMS, has a CWE-79 (Cross-site Scripting) vulnerability identified as CVE-2026-113659 affecting versions prior to 4.33.0. The vulnerability arises from the apos.http.parseQuery function automatically parsing query strings containing special keys (__proto__, constructor, prototype) that enable prototype pollution in the browser. This pollution can reach unsafe DOM sinks, allowing script execution in the context of an authenticated admin user who loads the affected admin bundle. The flaw does not affect anonymous visitors who do not load this context. The vulnerability has a CVSS 3.1 score of 6.1 (medium severity) and is fixed in version 4.33.0.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the browser session of an authenticated admin user by leveraging prototype pollution through crafted query strings. This can lead to limited confidentiality and integrity impacts within the admin context. There is no impact on availability. Anonymous users are not affected.

Upgrade ApostropheCMS to version 4.33.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated by the vendor advisory.