CVE-2026-33889

{
  "id": "CVE-2026-33889",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-15T20:16:35.850",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module, where color values prefixed with -- bypass TinyColor validation intended for CSS custom properties, and the launder.string() call performs only type coercion without stripping HTML metacharacters. These unsanitized values are then concatenated directly into <style> tags both in per-widget style elements rendered for all visitors and in the global stylesheet rendered for editors, with the output marked as safe HTML. An editor can inject a value which closes the style tag and executes arbitrary JavaScript in the browser of every visitor to any page containing the affected widget. This enables mass session hijacking, cookie theft, and privilege escalation to administrative control if an admin views draft content. This issue has been fixed in version 4.29.0."
    },
    {
      "lang": "es",
      "value": "ApostropheCMS es un sistema de gestión de contenido de código abierto basado en Node.js. Las versiones 4.28.0 y anteriores contienen una vulnerabilidad de cross-site scripting almacenado en el módulo @apostrophecms/color-field, donde los valores de color prefijados con -- eluden la validación de TinyColor destinada a las propiedades personalizadas de CSS, y la llamada a launder.string() realiza solo coerción de tipo sin eliminar los metacaracteres HTML. Estos valores no saneados se concatenan directamente en etiquetas [style] tanto en elementos de estilo por widget renderizados para todos los visitantes como en la hoja de estilo global renderizada para los editores, con la salida marcada como HTML seguro. Un editor puede inyectar un valor que cierra la etiqueta de estilo y ejecuta JavaScript arbitrario en el navegador de cada visitante de cualquier página que contenga el widget afectado. Esto permite el secuestro masivo de sesiones, el robo de cookies y la escalada de privilegios a control administrativo si un administrador ve contenido en borrador. Este problema ha sido solucionado en la versión 4.29.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "apostrophecms",
          "product": "apostrophe",
          "versions": [
            {
              "version": "< 4.29.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-16T11:26:46.114419Z",
          "id": "CVE-2026-33889",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.29.0",
              "matchCriteriaId": "2CFAFBDF-2EB1-404B-B370-8C510FC289AE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apostrophecms/apostrophe/commit/6a89bdb7acdb2e1e9bf1429961a6ba7f99410481",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97v6-998m-fp4g",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97v6-998m-fp4g",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}