CVE-2026-35569: ApostropheCMS Stored XSS Vulnerability

CVE-2026-35569 Overview

ApostropheCMS, an open-source Node.js content management system, contains a stored cross-site scripting (XSS) vulnerability in SEO-related fields. Versions 4.28.0 and prior allow user-controlled input in SEO Title and Meta Description fields to be rendered without proper output encoding into HTML contexts including <title> tags, <meta> attributes, and JSON-LD structured data. An attacker can inject a payload such as "></title><script>alert(1)</script> to break out of the intended HTML context and execute arbitrary JavaScript in the browser of any authenticated user who views the affected page. This vulnerability can be leveraged to perform authenticated API requests, access sensitive data such as usernames, email addresses, and roles via internal APIs, and exfiltrate it to an attacker-controlled server.

Critical Impact

Stored XSS vulnerability enables arbitrary JavaScript execution in authenticated user sessions, potentially leading to sensitive data exfiltration and unauthorized API access.

Affected Products

• ApostropheCMS versions 4.28.0 and prior
• Node.js applications using vulnerable ApostropheCMS packages
• Web applications with SEO fields rendered via the ApostropheCMS template engine

Discovery Timeline

• 2026-04-15 - CVE CVE-2026-35569 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-35569

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) arises from insufficient output encoding when user-controlled SEO field content is rendered in multiple HTML contexts. The vulnerability specifically affects how SEO Title and Meta Description values are embedded into <title> elements, <meta> tag attributes, and JSON-LD structured data blocks within <script type="application/ld+json"> elements.

The lack of proper escaping allows attackers to inject malicious payloads that break out of the intended HTML context. For JSON-LD structured data, the sequences </script>, <!--, and <![CDATA[ were not being escaped by JSON.stringify() alone, enabling injection of arbitrary HTML and JavaScript content.

Root Cause

The root cause of this vulnerability is the failure to escape special characters when embedding user-controlled data into HTML script contexts. Standard JSON.stringify() does not escape the < character, which allows attackers to inject </script> sequences that terminate the surrounding script tag prematurely. Additionally, line and paragraph separators (U+2028 and U+2029) are valid in JSON but can cause issues in JavaScript parsers.

Attack Vector

An attacker with content editing privileges can inject malicious JavaScript payloads through the SEO Title or Meta Description fields within the ApostropheCMS admin interface. When any authenticated user subsequently views the affected page, the injected script executes within their browser context. This network-accessible attack requires low privileges (content editor access) and user interaction (victim must view the page), but can result in complete compromise of the victim's session, including access to sensitive internal APIs.

// Security patch implementing safe JSON serialization for script contexts
// Source: https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3

+// Serialize `data` to a JSON string that is safe to embed inside an HTML
+// `<script>` element. `JSON.stringify` on its own does NOT escape the
+// sequences `</script>`, `<!--` or `<![CDATA[`, so untrusted data (e.g.
+// editor-provided SEO fields) in a JSON body could otherwise break out of
+// the surrounding script tag and inject arbitrary HTML/JS (stored XSS).
+// Escaping `<` as its `\\u003c` form keeps the JSON valid while neutralizing
+// all of those sequences. Line and paragraph separators are also escaped
+// since they are valid in JSON but illegal in some JavaScript parsers.
+//
+// This is the single source of truth for that escaping. The template
+// `renderNodes` helper uses it to render `{ json: ... }` node bodies, so in
+// most cases you should just build a node like:
+//
+//   {
+//     name: 'script',
+//     attrs: { type: 'application/ld+json' },
+//     body: [ { json: data } ]
+//   }
+//
+// and let `renderNodes` do the right thing.

+module.exports = function safeJsonForScript(data) {
+  return JSON.stringify(data, null, 2)
+    .replace(/</g, '\\\u003c')
+    .replace(/\\u2028/g, '\\\u2028')
+    .replace(/\\u2029/g, '\\\u2029');
+};

Source: GitHub Commit Changes

Detection Methods for CVE-2026-35569

Indicators of Compromise

• Unusual JavaScript sequences in SEO Title or Meta Description fields, particularly containing </script>, </title>, or <script> tags
• HTTP requests to unknown external domains originating from authenticated admin sessions
• Unexpected API calls accessing user information, roles, or sensitive configuration data
• Audit logs showing bulk access to internal API endpoints from client-side contexts

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution anomalies
• Monitor server-side logs for SEO field content containing HTML special characters or script tags
• Deploy web application firewall (WAF) rules to detect XSS payload patterns in form submissions
• Review ApostropheCMS audit logs for suspicious content modifications in SEO-related fields

Monitoring Recommendations

• Enable JavaScript error monitoring to detect CSP violations or unexpected script execution
• Set up alerts for outbound connections to unknown domains from authenticated user sessions
• Monitor for unusual patterns in internal API access, particularly bulk user data requests
• Implement real-time scanning of content submissions for known XSS payload signatures

How to Mitigate CVE-2026-35569

Immediate Actions Required

• Upgrade ApostropheCMS to version 4.29.0 or later immediately
• Audit existing SEO Title and Meta Description fields for malicious content
• Review user accounts with content editing privileges for unauthorized access
• Implement Content Security Policy headers to mitigate potential exploit impact

Patch Information

The vulnerability has been addressed in ApostropheCMS version 4.29.0. The fix introduces a new safeJsonForScript() function in packages/apostrophe/lib/safe-json-script.js that properly escapes the < character as \\u003c and handles Unicode line/paragraph separators. This ensures that user-controlled data cannot break out of script contexts. The patch has been integrated into the template rendering system via the renderNodes helper. For detailed information, refer to the GitHub Security Advisory GHSA-855c-r2vq-c292.

Workarounds

• Restrict SEO field editing permissions to trusted administrators only until patching is complete
• Implement server-side input validation to reject HTML special characters in SEO fields
• Deploy a Web Application Firewall with XSS detection rules as a defense-in-depth measure
• Enable strict Content Security Policy headers to prevent inline script execution

# Configuration example - NPM upgrade command
npm update apostrophe@4.29.0

# Verify installed version
npm list apostrophe

# Add CSP headers in your Express/Node.js configuration as temporary mitigation
# app.use(helmet.contentSecurityPolicy({
#   directives: {
#     defaultSrc: ["'self'"],
#     scriptSrc: ["'self'"],
#     objectSrc: ["'none'"]
#   }
# }));