{"id":"CVE-2026-42853","sourceIdentifier":"security-advisories@github.com","published":"2026-06-12T21:16:21.300","lastModified":"2026-10-26T11:10:00.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system. As of time of publication, no known patched versions are available."},{"lang":"es","value":"ApostropheCMS es un sistema de gestión de contenido de código abierto basado en Node.js. Las versiones del paquete @apostrophecms/cli hasta la 3.6.0 inclusive contienen una vulnerabilidad de inyección de comandos en el comando ’apos create’. La entrada proporcionada por el usuario desde la solicitud de contraseña se incrusta directamente en un comando de shell sin una sanitización o escape adecuados. Esto permite la ejecución de comandos arbitrarios en el sistema anfitrión. En el momento de la publicación, no hay versiones parcheadas conocidas disponibles."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"apostrophecms","product":"@apostrophecms/cli","versions":[{"version":"<= 3.6.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-13T03:34:07.787771Z","id":"CVE-2026-42853","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hcwq-x9fw-8cfq","source":"security-advisories@github.com"},{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hcwq-x9fw-8cfq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}