CVE-2026-112951: ApostropheCMS Color Field Validation Bypass Leading to Stored XSS
Summary
CVE-2026-112951: The color field accepts any string that *begins* with a valid rgb() / hsl() color, because TinyColor.isValid does not anchor its match at the end of the string. Affects apostrophe versions < 4.34.0. Fixed in 4.34.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is a content management system designed for building websites and applications with a focus on usability and flexibility. It allows users to create and manage content easily, providing features such as in-context editing, media management, and customizable workflows. However, a vulnerability exists in its color field validation, which can be exploited to execute arbitrary HTML and JavaScript code.
Vulnerability Detail
The vulnerability arises from the color field's acceptance of any string that begins with a valid rgb() or hsl() color format. The validation mechanism, relying on TinyColor, does not properly anchor its match at the end of the string. This oversight allows an authenticated user with edit rights to append arbitrary HTML after a valid color prefix, leading to stored cross-site scripting (XSS) when the stored value is rendered. The implications of this vulnerability are significant, as it enables attackers to execute malicious scripts in the browsers of visitors and administrators, potentially leading to session hijacking and unauthorized actions.
How To Fix
Minimum fixed version
4.34.0
This is the first release that contains the fix.
npm install apostrophe@4.34.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate color inputs to ensure they do not contain any additional HTML or JavaScript. However, this is not a complete solution and should not replace the necessary update to the patched version.
Conclusion
The ApostropheCMS vulnerability CVE-2026-112951 presents a significant risk due to its potential for stored XSS attacks. It is crucial for users to update to the patched version 4.34.0 or later and implement proper validation of color inputs to mitigate this risk.
See every vulnerability recorded for apostrophe →
FAQ
The vulnerability allows for stored XSS due to improper validation of color field inputs in ApostropheCMS.
Any authenticated user with edit permissions can exploit this vulnerability.
The vulnerability can lead to session hijacking and unauthorized actions performed as an administrator.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
