CVE-2026-113659

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions 3.x and 4.0.0 through 4.32.2

Description A client-side prototype pollution issue exists in the apos.http.parseQuery() function. The parser fails to sanitize the proto, constructor, and prototype keys when processing URL query strings. An unauthenticated attacker can send a crafted link to an authenticated user; when the victim loads a page with the admin bundle, the query string is automatically parsed, allowing the attacker to write arbitrary properties onto Object.prototype.

This pollution can be escalated to DOM-based Cross-Site Scripting (XSS) because the admin UI is built on Vue. A polluted enumerable property, such as innerHTML, is picked up by Vue's element-mount routine and written to the DOM, executing arbitrary JavaScript in the victim's session. This affects any logged-in user, from the guest role to the admin role.

Recommendations Update ApostropheCMS to version 4.33.0. As a temporary mitigation, restrict the number of users with authenticated accounts and advise users against opening untrusted links while logged in.