{"id":"EUVD-2026-105154","enisaUuid":"65844233-3a11-30e1-b999-f3c847e1421d","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb() or hsl() prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered, the payload executes, resulting in stored XSS. This issue is fixed in version 4.34.0.","datePublished":"Oct 20, 2026, 3:33:09 PM","dateUpdated":"Oct 20, 2026, 4:43:32 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmgj-9cwm-cf3h\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0\n","aliases":"CVE-2026-112951\nGHSA-vmgj-9cwm-cf3h\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"34a28141-03dd-3712-8021-feadec95473a","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"}],"enisaIdVendor":[{"id":"f2b893e0-d2d8-3a60-af4a-2f26dc01c4db","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"30fc493a-bedf-34a7-ad74-3af9b6d11018","vulnerability":{"id":"GHSA-vmgj-9cwm-cf3h","description":"ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix","datePublished":"Oct 21, 2026, 5:05:44 PM","dateUpdated":"Oct 21, 2026, 5:05:44 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmgj-9cwm-cf3h\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112951\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0\n","enisa_id":"EUVD-2026-105154\n","aliases":"CVE-2026-112951\nGHSA-vmgj-9cwm-cf3h\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9f566cad-73b1-3205-aaf1-bf74473298c9","vulnerability":{"id":"CVE-2026-112951","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the color field accepts trailing content after a valid rgb() or hsl() prefix because its TinyColor validation does not require the entire value to match a color. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered, the payload executes, resulting in stored XSS. This issue is fixed in version 4.34.0.","datePublished":"Oct 20, 2026, 3:33:09 PM","dateUpdated":"Oct 20, 2026, 4:43:32 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmgj-9cwm-cf3h\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0\n","enisa_id":"EUVD-2026-105154\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Oct 29, 2026, 7:14:24 AM","vulnerabilityProduct":[{"id":"1a01d541-bf67-340e-8d07-3a3b82391427","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"}],"vulnerabilityVendor":[{"id":"efe1b544-47dd-31b7-be72-14ca5f73ab7a","vendor":{"name":"apostrophecms"}}]}}],"enisaIdAdvisory":[]}