CVE-2026-45011: ApostropheCMS Stored XSS Vulnerability

CVE-2026-45011 Overview

CVE-2026-45011 is a stored cross-site scripting (XSS) vulnerability in ApostropheCMS, an open-source Node.js content management system. The flaw affects version 4.29.0 and resides in the image widget functionality. A user holding the Editor role can configure an image widget link to use a javascript: URL payload. Because editors hold publishing rights, the malicious widget reaches the live site. When any visitor or administrator clicks the affected image link, arbitrary JavaScript runs in their browser. No patched version was available at publication time. The weakness is classified under [CWE-79].

Critical Impact
Authenticated editors can inject persistent JavaScript that executes against administrators and public visitors, enabling session theft, account takeover, and full administrative compromise.

Affected Products

ApostropheCMS version 4.29.0
Deployments where the Editor role is delegated to non-trusted users
Sites publishing image widgets to public audiences

Discovery Timeline

2026-06-12 - CVE-2026-45011 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-45011

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the ApostropheCMS image widget. The widget accepts a link target supplied by an editor. The application fails to validate or sanitize the URL scheme before rendering it as an href attribute on the published page. An attacker authenticated with the Editor role supplies a javascript: URI as the image link. When a victim clicks the rendered image, the browser executes the attached script in the security context of the ApostropheCMS site.

Because editors are authorized to publish, the attacker does not require approval from a higher-privileged user. The payload persists on the live site and runs against every viewer who interacts with the widget, including administrators. Successful execution can hijack administrator sessions, perform CSRF-style actions, exfiltrate cookies, or pivot to broader site compromise. User interaction is required, which is reflected in the impact characteristics but does not meaningfully reduce risk on a public site.

Root Cause

The root cause is missing URL scheme validation on the image widget link field. ApostropheCMS allows arbitrary URI schemes including javascript:, data:, and vbscript: rather than restricting input to safe schemes such as http, https, mailto, or relative paths. Output encoding alone is insufficient for href attributes because browsers parse dangerous schemes regardless of HTML encoding.

Attack Vector

An attacker first obtains or compromises an Editor account. The attacker creates or edits a page containing an image widget and sets the widget link to a javascript: payload such as one that exfiltrates document.cookie to an attacker-controlled host. The editor publishes the page. Any visitor who clicks the image triggers script execution. See the GitHub Security Advisory for the upstream technical description.

// No verified exploit code is published.
// The vulnerable flow can be summarized as:
//   1. Editor opens image widget configuration
//   2. Editor sets link field to: javascript:<payload>
//   3. Editor publishes the page
//   4. Victim clicks the image -> payload executes in victim's browser

Detection Methods for CVE-2026-45011

Indicators of Compromise

Image widget link fields containing javascript:, data:, or vbscript: URI schemes in the ApostropheCMS database.
Outbound HTTP requests from end-user browsers to unfamiliar domains immediately after loading pages with image widgets.
Unexpected administrator session activity such as new editor accounts, role changes, or page edits originating from anomalous IP addresses.

Detection Strategies

Query the ApostropheCMS document store for widget records whose link fields begin with javascript: or other non-HTTP schemes.
Inspect rendered HTML for <a href="javascript: patterns within image widget output.
Review web server access logs for requests to admin endpoints originating from sessions that previously rendered a suspect widget.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script and javascript: URI violations.
Audit editor and administrator account activity, focusing on widget creation and page publishing events.
Alert on changes to image widget link fields following any editor account creation or password reset.

How to Mitigate CVE-2026-45011

Immediate Actions Required

Restrict the Editor role to fully trusted users until a patch is released by the ApostropheCMS maintainers.
Scan existing content for image widgets containing non-HTTP URI schemes and remove or sanitize them.
Deploy a strict Content Security Policy that disallows inline script execution and blocks javascript: URIs.

Patch Information

No patched version is available at the time of publication. Monitor the ApostropheCMS GitHub releases and the GitHub Security Advisory GHSA-5f64-7vfc-rcx6 for updates and apply fixes as soon as they ship.

Workarounds

Apply a reverse proxy or WAF rule that strips or rejects request payloads containing javascript: in image widget link fields.
Add a server-side validation hook that rejects widget submissions whose href values do not start with http://, https://, /, or mailto:.
Enforce a Content Security Policy header that prevents inline script execution on rendered pages.

bash

# Example NGINX Content Security Policy header to limit XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;