GitHub Advisoryadvisory · npm

GHSA-vmg4-6gfg-83qx ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

HIGH Published 2026-09-02 Modified 2026-10-28 Official page ↗
Aliases
CVE-2026-71553
Ecosystem
npm
Packages
apostrophe
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-1321
Reviewed
2026-09-02

Affected packages

• npm apostrophe: < 4.32.1 → fixed in 4.32.1

Description

The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/" with a valid editor session and body of {"toString.call":"x"}, overwriting the global toString function with value x. Fabian

Related

Alias · CVE (1)

  • CVE-2026-71553 ApostropheCMS is an open-source Node.js content management system. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References