CVE-2026-35569

{
  "id": "CVE-2026-35569",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-15T20:16:36.353",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts including <title> tags, <meta> attributes, and JSON-LD structured data. An attacker can inject a payload such as \"></title><script>alert(1)</script> to break out of the intended HTML context and execute arbitrary JavaScript in the browser of any authenticated user who views the affected page. This can be leveraged to perform authenticated API requests, access sensitive data such as usernames, email addresses, and roles via internal APIs, and exfiltrate it to an attacker-controlled server. This issue has been fixed in version 4.29.0."
    },
    {
      "lang": "es",
      "value": "ApostropheCMS es un sistema de gestión de contenido Node.js de código abierto. Las versiones 4.28.0 y anteriores contienen una vulnerabilidad de cross-site scripting almacenado en campos relacionados con SEO (Título SEO y Meta Descripción), donde la entrada controlada por el usuario se renderiza sin la codificación de salida adecuada en contextos HTML, incluyendo etiquetas [title], atributos [meta] y datos estructurados JSON-LD. Un atacante puede inyectar una carga útil como ”>[/title][script_tag]alert(1)[/script] para salir del contexto HTML previsto y ejecutar JavaScript arbitrario en el navegador de cualquier usuario autenticado que vea la página afectada. Esto puede aprovecharse para realizar solicitudes de API autenticadas, acceder a datos sensibles como nombres de usuario, direcciones de correo electrónico y roles a través de API internas, y exfiltrarlos a un servidor controlado por el atacante. Este problema ha sido solucionado en la versión 4.29.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "apostrophecms",
          "product": "apostrophe",
          "versions": [
            {
              "version": "< 4.29.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-16T14:14:28.804713Z",
          "id": "CVE-2026-35569",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.29.0",
              "matchCriteriaId": "2CFAFBDF-2EB1-404B-B370-8C510FC289AE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}