{"id":"EUVD-2026-36565","enisaUuid":"2dbdf985-2ca2-3148-be49-bb8763a51cb1","description":"ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system. As of time of publication, no known patched versions are available.","datePublished":"Jun 12, 2026, 8:37:00 PM","dateUpdated":"Jun 13, 2026, 3:34:34 AM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hcwq-x9fw-8cfq\n","aliases":"CVE-2026-42853\nGHSA-hcwq-x9fw-8cfq\n","assigner":"GitHub_M","epss":0.54,"enisaIdProduct":[{"id":"f948824b-8692-3384-a74d-bd81f26e490b","product":{"name":"@apostrophecms/cli","vendor":{"name":"apostrophecms"}},"product_version":"≤ 3.6.0"}],"enisaIdVendor":[{"id":"8752f8e4-bfac-3275-9f45-2602046d42e6","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"293e7f9b-923e-35be-a5c4-148ee0affcf6","vulnerability":{"id":"GHSA-hcwq-x9fw-8cfq","description":"@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input","datePublished":"May 14, 2026, 4:16:16 PM","dateUpdated":"Jun 12, 2026, 10:01:56 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hcwq-x9fw-8cfq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42853\nhttps://github.com/apostrophecms/apostrophe\n","enisa_id":"EUVD-2026-36565\n","aliases":"CVE-2026-42853\nGHSA-hcwq-x9fw-8cfq\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"87f1540f-bcde-35cc-8aa2-c19b9b282266","vulnerability":{"id":"CVE-2026-42853","description":"ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system. As of time of publication, no known patched versions are available.","datePublished":"Jun 12, 2026, 8:37:00 PM","dateUpdated":"Jun 13, 2026, 3:34:34 AM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hcwq-x9fw-8cfq\n","enisa_id":"EUVD-2026-36565\n","assigner":"GitHub_M","epss":0.54,"dataProcessed":"Nov 3, 2026, 7:16:55 AM","vulnerabilityProduct":[{"id":"7579471a-1120-36a9-86b3-9f7f63ce4692","product":{"name":"@apostrophecms/cli","vendor":{"name":"apostrophecms"}},"product_version":"≤ 3.6.0"}],"vulnerabilityVendor":[{"id":"36f5ecbf-f8ec-3b12-9289-4e01b6ab21e4","vendor":{"name":"apostrophecms"}}]}}],"enisaIdAdvisory":[]}