CVE-2026-33889 is a stored cross-site scripting vulnerability in ApostropheCMS (Node.js CMS) versions prior to 4.29.0. The flaw exists in the @apostrophecms/color-field module where color values prefixed with '--' bypass TinyColor validation. The launder.string() function only coerces types without removing HTML metacharacters, allowing crafted input to close <style> tags and inject arbitrary JavaScript. This malicious script executes in the context of any visitor viewing the affected widget, enabling session hijacking, cookie theft, and administrative privilege escalation if an admin views the injected draft content. The vulnerability is resolved in version 4.29.0.

Exploitation allows an authenticated editor to inject malicious JavaScript that executes in the browsers of all visitors to affected pages. This can lead to session hijacking, cookie theft, and privilege escalation to administrative control if an administrator views the compromised draft content. The CVSS score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality and integrity.

Upgrade ApostropheCMS to version 4.29.0 or later, where this vulnerability has been fixed. Since this is a self-hosted product, administrators must apply the update to remediate the issue. Patch status is confirmed by the vendor's versioning. No alternative mitigations are indicated.