CVE-2026-35569 Details
Description
ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts including <title> tags, <meta> attributes, and JSON-LD structured data. An attacker can inject a payload such as "></title><script>alert(1)</script> to break out of the intended HTML context and execute arbitrary JavaScript in the browser of any authenticated user who views the affected page. This can be leveraged to perform authenticated API requests, access sensitive data such as usernames, email addresses, and roles via internal APIs, and exfiltrate it to an attacker-controlled server. This issue has been fixed in version 4.29.0.
A stored cross-site scripting vulnerability has been identified in ApostropheCMS versions through 4.28.0. The issue resides in SEO-related fields, specifically the SEO Title and Meta Description, where user input is not properly encoded before being rendered in HTML contexts. This flaw allows an attacker to inject scripts that are executed in the browser of any authenticated user who views the affected page. Exploitation of this vulnerability could lead to unauthorized access to sensitive data via internal APIs, such as usernames, email addresses, and user roles.
Users are advised to upgrade to ApostropheCMS version 4.29.0 or later, which addresses this vulnerability by introducing proper output encoding for SEO fields and a mechanism for safely rendering JSON-LD structured data.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apostrophecms apostrophecms | < 4.29.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | CVE Modified | [email protected] |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 15, 2026 | New CVE Received | [email protected] |