Open Redirect Vulnerability in apostrophe
Summary
GHSA-h97g-4mx7-5p2p: Open Redirect in apostrophe. Affects apostrophe versions < 2.92.0. Fixed in 2.92.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The apostrophe package is an open-source content management system (CMS) built on Node.js. It provides a framework for creating and managing websites, with features such as content editing, user management, and template rendering. The package is widely used in web development projects to simplify the creation and maintenance of websites. However, versions prior to 2.92.0 are vulnerable to an Open Redirect vulnerability.
Vulnerability Detail
The Open Redirect vulnerability in apostrophe allows attackers to redirect users to third-party websites. This occurs when escaped URLs followed by a trailing / are appended at the end of a request. The package fails to properly validate and sanitize these URLs, leading to potential phishing attacks or unauthorized redirects. The impact of this vulnerability can range from tricking users into visiting malicious websites to bypassing security measures and gaining unauthorized access to sensitive information.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.92.0
This is the first release that contains the fix.
npm install apostrophe@2.92.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Open Redirect vulnerability in apostrophe can have serious security implications, potentially leading to phishing attacks and unauthorized access. It is crucial to update the package to version 2.92.0 or later to fix this vulnerability and protect your application. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for apostrophe →
FAQ
An Open Redirect vulnerability allows attackers to redirect users to external websites, potentially leading to phishing attacks or unauthorized access.
The vulnerability in apostrophe occurs when escaped URLs followed by a trailing / are appended at the end of a request. The package fails to properly validate and sanitize these URLs, allowing attackers to redirect users to third-party websites.
The consequences of this vulnerability can include tricking users into visiting malicious websites, bypassing security measures, and gaining unauthorized access to sensitive information.
To protect your application, it is recommended to update apostrophe to version 2.92.0 or later. This will ensure that the Open Redirect vulnerability is fixed and URLs are properly validated and sanitized.
No, there is no known workaround for this vulnerability. It is recommended to update apostrophe to the latest version to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
