CVE-2026-33889 is a stored XSS vulnerability in ApostropheCMS (Node.js CMS) versions prior to 4.29.0. The vulnerability arises because the @apostrophecms/color-field module improperly sanitizes color values prefixed with '--', which bypass TinyColor validation. The launder.string() function only coerces types without removing HTML metacharacters. These unsafe values are concatenated directly into <style> tags in both per-widget and global stylesheets, marked as safe HTML. An editor can exploit this to close the style tag and inject arbitrary JavaScript, affecting all visitors and potentially allowing administrative privilege escalation when admins view draft content.

Successful exploitation allows an attacker with editor privileges to execute arbitrary JavaScript in the browsers of all visitors to pages containing the affected widget. This can result in mass session hijacking, cookie theft, and privilege escalation to administrative control if an admin views the malicious draft content. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact.

This vulnerability has been fixed in ApostropheCMS version 4.29.0. Users should upgrade to version 4.29.0 or later to remediate this issue. Since no official patch link or vendor advisory is provided, verify the fix by consulting the ApostropheCMS release notes or official channels. Until upgraded, restrict editor privileges and avoid loading untrusted draft content in administrative sessions.