PT-2026-33171 · Unknown+1 · Apostrophe Cms+1

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-33889

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.29.0

Description A stored cross-site scripting issue exists in the @apostrophecms/color-field module. The convert() function uses TinyColor for validation but exempts any value starting with --, which is intended for CSS custom properties. Because the launder.string() call only performs type coercion and does not strip HTML metacharacters, an editor can inject malicious values. These unsanitized values are concatenated directly into <style> tags within per-widget style elements for all visitors and in the global stylesheet for editors. An attacker with editor privileges can inject a value that closes the style tag and executes arbitrary JavaScript in the browser of any visitor or administrator viewing the content. This can lead to mass session hijacking, cookie theft, and privilege escalation to administrative control.

Recommendations Update to version 4.29.0. As a temporary workaround, restrict the use of the @apostrophecms/color-field module or limit editor permissions for styling widgets until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33889

GHSA-97V6-998M-FP4G

Affected Products

@Apostrophecms/Color-Field

Apostrophe Cms

References · 6

• 🔥 https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97v6-998m-fp4g · Exploit
• https://github.com/apostrophecms/apostrophe/commit/6a89bdb7acdb2e1e9bf1429961a6ba7f99410481 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33889 · Security Note
• https://osv.dev/vulnerability/GHSA-97v6-998m-fp4g · Vendor Advisory
• https://github.com/apostrophecms/apostrophe · Note
• https://twitter.com/CVEnew/status/2044701621024890986 · Twitter Post