{"id":"EUVD-2026-105171","enisaUuid":"ea5fac5d-72a6-3c0b-b558-60fc030bb364","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered. This issue is fixed in version 4.34.0.","datePublished":"Oct 20, 2026, 4:03:53 PM","dateUpdated":"Oct 20, 2026, 4:59:06 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-7jg5-frgc-c67w\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0\n","aliases":"CVE-2026-112958\nGHSA-7jg5-frgc-c67w\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"08394cef-59c1-383b-9276-045425c53ae3","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"}],"enisaIdVendor":[{"id":"9e6de608-00bf-38f5-945d-608c505d11ad","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"6758046f-f868-3236-850d-aa85ed87ec62","vulnerability":{"id":"CVE-2026-112958","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered. This issue is fixed in version 4.34.0.","datePublished":"Oct 20, 2026, 4:03:53 PM","dateUpdated":"Oct 20, 2026, 4:59:06 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-7jg5-frgc-c67w\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0\n","enisa_id":"EUVD-2026-105171\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Oct 27, 2026, 7:14:58 AM","vulnerabilityProduct":[{"id":"c3306ba2-8c40-36e1-9ac8-cd0f0f871a53","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"}],"vulnerabilityVendor":[{"id":"6da4f7e0-e99b-3509-b2b8-d85a8d2a30ee","vendor":{"name":"apostrophecms"}}]}},{"id":"9465b0e0-4d1d-3ba9-be8c-c4efbe965aa8","vulnerability":{"id":"GHSA-7jg5-frgc-c67w","description":"ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization","datePublished":"Oct 21, 2026, 5:15:07 PM","dateUpdated":"Oct 21, 2026, 5:15:07 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-7jg5-frgc-c67w\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112958\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0\n","enisa_id":"EUVD-2026-105171\n","aliases":"GHSA-7jg5-frgc-c67w\nCVE-2026-112958\n","epss":0.0,"dataProcessed":"Oct 27, 2026, 7:03:17 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}