CVE-2026-45011 Details
Description
ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the live site. When another user, including an administrator or public visitor, clicks the affected image/link, arbitrary JavaScript executes in the victim’s browser. As of time of publication, no known patched versions are available.
A stored cross-site scripting vulnerability has been identified in ApostropheCMS version 4.29.0, specifically within the image widget functionality. This issue allows users with the Editor role to inject a JavaScript payload into an image widget link using a 'javascript:' URL. Since editors can publish pages, the malicious widget can be made live. When another user, including administrators or public visitors, clicks the affected image link, the injected JavaScript executes in their browser, potentially leading to unauthorized actions or information access.
It is recommended to validate and sanitize all user-supplied URLs in widget link fields. Dangerous URL schemes like 'javascript:' and 'data:' should be rejected, while safe protocols such as 'http:', 'https:', 'mailto:', and appropriate relative URLs should be allowed. URLs should be normalized and validated server-side before storage, safely encoded in templates, and a strict Content Security Policy considered to mitigate XSS impact.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5f64-7vfc-rcx6 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe%404.29.0 | [email protected] | Vendor |
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5f64-7vfc-rcx6 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ApostropheCMS | 4.29.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |