{"id":"CVE-2026-112951","kind":"vulnerability","aliases":["CVE-2026-112951","GHSA-vmgj-9cwm-cf3h"],"related":[],"title":"ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix","description":"### Summary\nThe color field accepts any string that *begins* with a valid `rgb()` / `hsl()` color, because `TinyColor.isValid` does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered , the payload executes, resulting in stored XSS.\n\n### Details\nServer-side validation of the color field relies on TinyColor:\n\n```js\nconst { TinyColor } = require('@ctrl/tinycolor');\nif (!new TinyColor(value).isValid) throw self.apos.error('invalid');\n```\n\nTinyColor's `rgb`/`hsl` matchers are not anchored at the end of the string, while hex matchers are. Tested with @ctrl/tinycolor\n\n| Input | `isValid` |\n|---|---|\n| `rgb(1,2,3)<img src=x onerror=alert(1)>` | `true` |\n| `rgb(1,2,3)</textarea><script>alert(1)</script>` | `true` |\n| `hsl(0,100%,50%);--x:1}</style><script>alert(1)</script>` | `true` |\n| `#ff0000<img src=x onerror=alert(1)>` | `false` |\n\nThe value is saved to MongoDB unchanged (not normalized to hex8).\n\n### Relation to GHSA-97v6-998m-fp4g\nGHSA-97v6 addressed CSS custom property injection escaping a `<style>` context. The root cause (validation that accepts trailing content after a valid color) still exists in <= 4.32.2, so [FILL IN: either \"the style-tag sink remains exploitable via `</style>`\" OR \"a separate HTML sink at X is exploitable\"]. Fixing the validation (requiring the full string to be a color, or storing only TinyColor's normalized output) would close both.\n\n### Impact\nAny user with edit permission can plant persistent JavaScript that runs in the browser of visitors and administrators viewing the affected page, enabling session hijacking and actions as an admin.\n\n### Suggested fix\nReject values unless the entire string is a valid color, e.g. normalize on save:\n```js\nconst c = new TinyColor(value);\nif (!c.isValid) throw self.apos.error('invalid');\nvalue = c.toHex8String(); // store only normalized output\n```","summary":"ApostropheCMS accepts a color field value that starts with a valid rgb() or hsl() color and lets arbitrary HTML follow it, because the TinyColor validation is not anchored at the end of the string. An authenticated user with edit rights can store a script payload that runs in the browser of anyone who views the page, including administrators, enabling session hijacking.","severity":"medium","cvss":5.400000095367432,"epss":0.0030300000216811895,"exploited":false,"exploited_at":null,"products":[{"name":"apostrophe","fixed":["4.34.0"],"affected":"< 4.34.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["apostrophe","cms","cwe-79","node.js","package","self-hosted"],"not_affected_if":["no-color-field-in-use","trusted-editors-only","version-4.34.0-or-later"],"how_to_check":"Check the installed apostrophe version in package.json or package-lock.json (npm ls apostrophe).\nIf below 4.34.0, search your stored color field values for entries containing characters after a closing parenthesis, such as '<' or '}'.","fix":"Upgrade apostrophe to 4.34.0 or later.","status":"open","published_at":"2026-10-20T16:17:05+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T19:58:15+00:00","updated_at":"2026-10-23T21:57:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:58:15Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade apostrophe to 4.34.0 or later.\nUnknown whether a data cleanup is needed for values already stored; the sources do not say.","summary":"ApostropheCMS accepts a color field value that starts with a valid rgb() or hsl() color and lets arbitrary HTML follow it, because the TinyColor validation is not anchored at the end of the string. An authenticated user with edit rights can store a script payload that runs in the browser of anyone who views the page, including administrators, enabling session hijacking.","category":"package","who_cares":["apostrophe","self-hosted","cms","node.js"],"confidence":0.7,"analyst_note":"Sources leave a placeholder in the GHSA description about whether the style-tag sink or another HTML sink is exploitable; confirm against https://github.com/advisories/GHSA-vmgj-9cwm-cf3h and the 4.34.0 release notes, and whether previously stored values need cleanup.","how_to_check":"Check the installed apostrophe version in package.json or package-lock.json (npm ls apostrophe).\nIf below 4.34.0, search your stored color field values for entries containing characters after a closing parenthesis, such as '<' or '}'.\nunknown","needs_analyst":true,"not_affected_if":["version-4.34.0-or-later","no-color-field-in-use","trusted-editors-only"],"severity_if_unknown":"medium"},"cost_usd":0.000519,"input_tokens":2761,"output_tokens":485,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112951':18A,26A '-2026':17A,25A '-79':31B '/hsl':14A '0':219C '1':203C,211C,214C,223C,231C '100':220C '2':204C,215C '3':205C,216C '50':221C '97v6':248C,253C '998m':249C '9cwm':22A 'accept':38B,102C 'action':318C 'address':254C 'admin':321C 'administr':94B,309C 'affect':312C 'alert':210C,230C 'allow':6A 'anchor':64B,117C,186C 'anyon':88B 'apostroph':28B 'apostrophe':27A 'apostrophecm':1A,37B 'append':11A 'arbitrari':54B,134C 'authent':72B,127C 'begin':106C 'browser':86B,305C 'bypass':5A 'c':340C 'c.isvalid':345C 'c.tohex8string':350C 'cf3h':23A 'close':289C 'cms':29B 'color':2A,40B,51B,100C,112C,139C,161C,280C,333C 'const':167C,339C 'css':255C 'ctrl/tinycolor':170C,199C 'custom':256C 'cve':16A,24A 'cwe':30B 'detail':154C 'e.g':334C 'edit':75B,130C,295C 'enabl':95B,314C 'end':67B,122C,189C 'entir':328C 'escap':259C 'execut':149C 'exploit':269C 'fals':232C 'ff0000':225C 'field':3A,41B,101C,162C 'fix':270C,323C 'follow':56B 'fp4g':250C 'full':275C 'ghsa':20A,247C,252C 'ghsa-97v6':251C 'ghsa-97v6-998m-fp4g':246C 'ghsa-vmgj-9cwm-cf3h':19A 'hex':194C 'hex8':243C 'hijack':97B,316C 'host':36B 'hsl':50B,111C,182C,218C 'html':10A,55B,135C,264C 'img':206C,226C 'impact':291C 'includ':93B 'inject':258C 'input':200C 'invalid':178C,348C 'isvalid':175C,201C 'javascript':300C 'js':166C,338C 'let':53B 'match':119C 'matcher':183C,195C 'mongodb':238C 'new':172C,341C 'node.js':32B 'normal':241C,286C,335C,353C 'onerror':209C,229C 'output':287C,354C 'packag':33B 'page':92B,313C 'payload':81B,148C 'permiss':296C 'persist':299C 'plant':298C 'prefix':15A,140C 'properti':257C 'reject':324C 'relat':244C 'reli':163C 'render':146C 'requir':169C,273C 'result':150C 'rgb':13A,48B,110C,181C,202C,213C 'right':76B,131C 'run':83B,302C 'save':236C,337C 'script':80B 'self':35B 'self-host':34B 'self.apos.error':177C,347C 'separ':263C 'server':156C 'server-sid':155C 'session':96B,315C 'side':157C 'sink':265C 'src':207C,227C 'start':44B 'store':7A,78B,133C,143C,152C,282C,351C 'string':70B,104C,125C,192C,276C,329C 'suggest':322C 'summari':98C 'test':197C 'throw':176C,346C 'tinycolor':60B,165C,168C,173C,179C,284C,342C 'tinycolor.isvalid':114C 'true':212C,217C,224C 'unchang':239C 'unless':326C 'user':73B,128C,293C 'valid':4A,47B,61B,109C,138C,158C,272C,332C 'valu':42B,144C,174C,234C,325C,343C,349C 'via':9A 'view':90B,310C 'visitor':307C 'vmgj':21A 'would':288C 'x':208C,222C,228C,267C 'xss':8A,153C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vmgj-9cwm-cf3h","url":"https://github.com/advisories/GHSA-vmgj-9cwm-cf3h","severity":"medium","published_at":"2026-10-21T17:05:44+00:00","modified_at":"2026-10-21T17:05:44+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-112951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112951","severity":null,"published_at":"2026-10-20T16:17:05+00:00","modified_at":"2026-10-20T19:53:10+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}