Skip to main content
cve.nowby Sazabi
← npm
npmPackage

apostrophe

33 known vulnerabilities (2 critical, 9 high, 19 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
4.34.0 (Oct 14, 2026): no advisory affects it
Newest unaffected release
4.34.0 (Oct 14, 2026), the latest release
Advisories
33 · 2 critical, 9 high, 19 medium, 3 low
Weekly downloads
23.4K
Dependents
5
Releases
500+ since 0.5.386 (Oct 11, 2016)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 33 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 33

  • ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

    Affected: fixed in 4.33.0.

    Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 4.34.0, is not affected.

    93% of apostrophe downloads last week were affected versions (31.8K).

  • CVE-2026-113710Medium 5.9

    ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

    Affected: fixed in 4.33.0.

    Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 4.34.0, is not affected.

    93% of apostrophe downloads last week were affected versions (31.8K).

  • CVE-2026-113669Medium 5.3

    ApostropheCMS: Cross-domain session token in URL confers session takeover

    Affected: fixed in 4.33.0.

    Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 4.34.0, is not affected.

    93% of apostrophe downloads last week were affected versions (31.8K).

  • CVE-2026-113668Medium 5.3

    ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

    Affected: fixed in 4.33.0.

    Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 4.34.0, is not affected.

    93% of apostrophe downloads last week were affected versions (31.8K).

  • ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service

    Affected: fixed in 4.33.0.

    Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 4.34.0, is not affected.

    93% of apostrophe downloads last week were affected versions (31.8K).

  • ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

    Affected: fixed in 4.33.0.

    Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 4.34.0, is not affected.

    93% of apostrophe downloads last week were affected versions (31.8K).

  • CVE-2026-113660Medium 4.3

    ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

    Affected: fixed in 4.33.0.

    Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 4.34.0, is not affected.

    93% of apostrophe downloads last week were affected versions (31.8K).

  • CVE-2026-113659Medium 6.1

    ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

    Affected: fixed in 4.33.0.

    Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 4.34.0, is not affected.

    93% of apostrophe downloads last week were affected versions (31.8K).

  • ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

    Affected: fixed in 4.33.0.

    Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 4.34.0, is not affected.

    93% of apostrophe downloads last week were affected versions (31.8K).

  • CVE-2026-113649Medium 6.5

    ApostropheCMS: Import API bypasses publication roles for protected content

    Affected: fixed in 4.34.0.

    Fixed in 4.34.0 (released Oct 14, 2026, 6 days before disclosure).

    The latest release, 4.34.0, is not affected.

    94% of apostrophe downloads last week were affected versions (32.1K).

  • CVE-2026-113655Medium 4.3

    ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

    Affected: fixed in 4.33.0.

    Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 4.34.0, is not affected.

    93% of apostrophe downloads last week were affected versions (31.8K).

  • CVE-2026-113653Medium 6.9

    ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)

    Affected: fixed in 4.33.0.

    Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 4.34.0, is not affected.

    93% of apostrophe downloads last week were affected versions (31.8K).

  • CVE-2026-112958Medium 5.4

    ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

    Affected: fixed in 4.34.0.

    Fixed in 4.34.0 (released Oct 14, 2026, 6 days before disclosure).

    The latest release, 4.34.0, is not affected.

    94% of apostrophe downloads last week were affected versions (32.1K).

  • CVE-2026-112957Medium 4.3

    ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

    Affected: fixed in 4.34.0.

    Fixed in 4.34.0 (released Oct 14, 2026, 6 days before disclosure).

    The latest release, 4.34.0, is not affected.

    94% of apostrophe downloads last week were affected versions (32.1K).

  • CVE-2026-112954Medium 5.3

    ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

    Affected: fixed in 4.34.0.

    Fixed in 4.34.0 (released Oct 14, 2026, 6 days before disclosure).

    The latest release, 4.34.0, is not affected.

    94% of apostrophe downloads last week were affected versions (32.1K).

Show all 33 advisoriesShow fewer advisories
  • CVE-2026-112952Medium 4.3

    ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

    Affected: fixed in 4.34.0.

    Fixed in 4.34.0 (released Oct 14, 2026, 6 days before disclosure).

    The latest release, 4.34.0, is not affected.

    94% of apostrophe downloads last week were affected versions (32.1K).

  • CVE-2026-112951Medium 5.4

    ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

    Affected: fixed in 4.34.0.

    Fixed in 4.34.0 (released Oct 14, 2026, 6 days before disclosure).

    The latest release, 4.34.0, is not affected.

    94% of apostrophe downloads last week were affected versions (32.1K).

  • CVE-2026-110904Medium 5.3

    ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 c

    Affected: fixed in 4.33.0.

    Fixed in 4.33.0 (released Sep 30, 2026, 15 days before disclosure).

    The latest release, 4.34.0, is not affected.

    93% of apostrophe downloads last week were affected versions (31.8K).

  • ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

    Affected: fixed in 4.32.1.

    Fixed in 4.32.1 (released Aug 13, 2026, 4 days before disclosure).

    The latest release, 4.34.0, is not affected.

    92% of apostrophe downloads last week were affected versions (31.5K).

  • CVE-2026-63669Medium 6.5

    ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a…

    Affected: fixed in 4.32.0.

    Fixed in 4.32.0 (released Jul 10, 2026, 38 days before disclosure).

    The latest release, 4.34.0, is not affected.

    92% of apostrophe downloads last week were affected versions (31.3K).

  • CVE-2026-53609Critical 9.1

    Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

    Affected: fixed in 4.31.0.

    Fixed in 4.31.0 (released Jun 10, 2026, 2 days before disclosure).

    The latest release, 4.34.0, is not affected.

    92% of apostrophe downloads last week were affected versions (31.2K).

  • @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

    Affected: fixed in 4.31.0.

    Fixed in 4.31.0 (released Jun 10, 2026, 2 days before disclosure).

    The latest release, 4.34.0, is not affected.

    92% of apostrophe downloads last week were affected versions (31.2K).

  • Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation

    Affected: through 4.29.0.

    Fixed in 4.30.0 (released May 13, 2026, 30 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 4.34.0, is not affected.

    91% of apostrophe downloads last week were affected versions (31.1K).

  • Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

    Affected: through 4.29.0.

    Fixed in 4.30.0 (released May 13, 2026, 30 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 4.34.0, is not affected.

    91% of apostrophe downloads last week were affected versions (31.1K).

  • Apostrophe has stored XSS via javascript: URL in Image Widget Link

    Affected: versions 4.29.0.

    Fixed in 4.30.0 (released May 13, 2026, 30 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 4.34.0, is not affected.

    0.1% of apostrophe downloads last week were affected versions (50).

  • CVE-2026-39857Medium 5.3

    Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions

    Affected: fixed in 4.29.0.

    Fixed in 4.29.0 (released Apr 15, 2026, the day of disclosure).

    The latest release, 4.34.0, is not affected.

    91% of apostrophe downloads last week were affected versions (31K).

  • ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS

    Affected: fixed in 4.29.0.

    Fixed in 4.29.0 (released Apr 15, 2026, the day of disclosure).

    The latest release, 4.34.0, is not affected.

    91% of apostrophe downloads last week were affected versions (31K).

  • CVE-2026-33889Medium 5.4

    ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context

    Affected: fixed in 4.29.0.

    Fixed in 4.29.0 (released Apr 15, 2026, the day of disclosure).

    The latest release, 4.34.0, is not affected.

    91% of apostrophe downloads last week were affected versions (31K).

  • CVE-2026-33888Medium 5.3

    ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API

    Affected: fixed in 4.29.0.

    Fixed in 4.29.0 (released Apr 15, 2026, the day of disclosure).

    The latest release, 4.34.0, is not affected.

    91% of apostrophe downloads last week were affected versions (31K).

  • ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint

    Affected: fixed in 4.29.0.

    Fixed in 4.29.0 (released Apr 15, 2026, the day of disclosure).

    The latest release, 4.34.0, is not affected.

    91% of apostrophe downloads last week were affected versions (31K).

  • ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

    Affected: fixed in 4.28.0.

    Fixed in 4.28.0 (released Mar 18, 2026, the day of disclosure).

    The latest release, 4.34.0, is not affected.

    91% of apostrophe downloads last week were affected versions (31K).

  • CVE-2021-25979Critical 9.8

    Apostrophe - Insufficient Session Expiration

    Affected: from 2.63.0, fixed in 3.4.0.

    Fixed in 3.4.0 (released Sep 13, 2021, 56 days before disclosure).

    The latest release, 4.34.0, is not affected.

    13% of apostrophe downloads last week were affected versions (4.3K).

  • CVE-2021-25978Medium 5.4

    Apostrophe - XSS

    Affected: from 2.63.0, fixed in 3.4.0.

    Fixed in 3.4.0 (released Sep 13, 2021, 55 days before disclosure).

    The latest release, 4.34.0, is not affected.

    13% of apostrophe downloads last week were affected versions (4.3K).