---
id: CVE-2026-112951
aliases:
  - GHSA-vmgj-9cwm-cf3h
title: >-
  ApostropheCMS: Color field validation bypass allows stored XSS via HTML
  appended after rgb()/hsl() prefix
summary: >-
  ApostropheCMS: Color field validation bypass allows stored XSS via HTML
  appended after rgb()/hsl() prefix
severity: medium
cvss: 5.4
cwe:
  - CWE-79
vendor: apostrophe
product: apostrophe
ecosystem: npm
affected:
  - apostrophe < 4.34.0
patched:
  - apostrophe 4.34.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T17:05:44Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-vmgj-9cwm-cf3h'
references:
  - url: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmgj-9cwm-cf3h
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-112951'
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
  - url: 'https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0'
  - url: 'https://github.com/advisories/GHSA-vmgj-9cwm-cf3h'
tags:
  - ghsa
  - npm
  - cve.org
  - exploit-available
epss: 0.00304
epssPercentile: 0.23006
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-20T16:42:47.280895Z'
ingestedAt: '2026-10-20T16:10:53.309Z'
---

## Overview

### Summary
The color field accepts any string that *begins* with a valid `rgb()` / `hsl()` color, because `TinyColor.isValid` does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered , the payload executes, resulting in stored XSS.

### Details
Server-side validation of the color field relies on TinyColor:

```js
const { TinyColor } = require('@ctrl/tinycolor');
if (!new TinyColor(value).isValid) throw self.apos.error('invalid');
```

TinyColor's `rgb`/`hsl` matchers are not anchored at the end of the string, while hex matchers are. Tested with @ctrl/tinycolor

| Input | `isValid` |
|---|---|
| `rgb(1,2,3)<img src=x onerror=alert(1)>` | `true` |
| `rgb(1,2,3)</textarea><script>alert(1)</script>` | `true` |
| `hsl(0,100%,50%);--x:1}</style><script>alert(1)</script>` | `true` |
| `#ff0000<img src=x onerror=alert(1)>` | `false` |

The value is saved to MongoDB unchanged (not normalized to hex8).

### Relation to GHSA-97v6-998m-fp4g
GHSA-97v6 addressed CSS custom property injection escaping a `<style>` context. The root cause (validation that accepts trailing content after a valid color) still exists in <= 4.32.2, so [FILL IN: either "the style-tag sink remains exploitable via `</style>`" OR "a separate HTML sink at X is exploitable"]. Fixing the validation (requiring the full string to be a color, or storing only TinyColor's normalized output) would close both.

### Impact
Any user with edit permission can plant persistent JavaScript that runs in the browser of visitors and administrators viewing the affected page, enabling session hijacking and actions as an admin.

### Suggested fix
Reject values unless the entire string is a valid color, e.g. normalize on save:
```js
const c = new TinyColor(value);
if (!c.isValid) throw self.apos.error('invalid');
value = c.toHex8String(); // store only normalized output
```

## Affected packages

- `apostrophe < 4.34.0`

## Remediation

Upgrade to a patched release:

- `apostrophe 4.34.0`