{"id":"CVE-2026-112951","aliases":["GHSA-vmgj-9cwm-cf3h"],"title":"ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix","summary":"ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix","severity":"medium","cvss":5.4,"cwe":["CWE-79"],"vendor":"apostrophe","product":"apostrophe","ecosystem":"npm","affected":["apostrophe < 4.34.0"],"patched":["apostrophe 4.34.0"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T17:05:44Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-vmgj-9cwm-cf3h","references":[{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmgj-9cwm-cf3h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112951"},{"url":"https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498"},{"url":"https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea"},{"url":"https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0"},{"url":"https://github.com/advisories/GHSA-vmgj-9cwm-cf3h"}],"tags":["ghsa","npm","cve.org","exploit-available"],"epss":0.00304,"epssPercentile":0.23006,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T16:42:47.280895Z"},"ingestedAt":"2026-10-20T16:10:53.309Z","slug":"CVE-2026-112951","body":"## Overview\n\n### Summary\nThe color field accepts any string that *begins* with a valid `rgb()` / `hsl()` color, because `TinyColor.isValid` does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered , the payload executes, resulting in stored XSS.\n\n### Details\nServer-side validation of the color field relies on TinyColor:\n\n```js\nconst { TinyColor } = require('@ctrl/tinycolor');\nif (!new TinyColor(value).isValid) throw self.apos.error('invalid');\n```\n\nTinyColor's `rgb`/`hsl` matchers are not anchored at the end of the string, while hex matchers are. Tested with @ctrl/tinycolor\n\n| Input | `isValid` |\n|---|---|\n| `rgb(1,2,3)<img src=x onerror=alert(1)>` | `true` |\n| `rgb(1,2,3)</textarea><script>alert(1)</script>` | `true` |\n| `hsl(0,100%,50%);--x:1}</style><script>alert(1)</script>` | `true` |\n| `#ff0000<img src=x onerror=alert(1)>` | `false` |\n\nThe value is saved to MongoDB unchanged (not normalized to hex8).\n\n### Relation to GHSA-97v6-998m-fp4g\nGHSA-97v6 addressed CSS custom property injection escaping a `<style>` context. The root cause (validation that accepts trailing content after a valid color) still exists in <= 4.32.2, so [FILL IN: either \"the style-tag sink remains exploitable via `</style>`\" OR \"a separate HTML sink at X is exploitable\"]. Fixing the validation (requiring the full string to be a color, or storing only TinyColor's normalized output) would close both.\n\n### Impact\nAny user with edit permission can plant persistent JavaScript that runs in the browser of visitors and administrators viewing the affected page, enabling session hijacking and actions as an admin.\n\n### Suggested fix\nReject values unless the entire string is a valid color, e.g. normalize on save:\n```js\nconst c = new TinyColor(value);\nif (!c.isValid) throw self.apos.error('invalid');\nvalue = c.toHex8String(); // store only normalized output\n```\n\n## Affected packages\n\n- `apostrophe < 4.34.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `apostrophe 4.34.0`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":226001,"id":"CVE-2026-112951","ts":1792516418286,"field":"exploit_available","old":"false","new":"true"}]}