PT-2026-41135 · Apostrophecms+2 · @Apostrophecms/Cli+1

CVE-2026-42853 · Published 2026-05-14 · Updated 2026-06-14

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions @apostrophecms/cli versions prior to 3.6.1

Description ApostropheCMS is an open-source Node.js content management system. The @apostrophecms/cli package contains a command injection issue in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping, allowing the execution of arbitrary commands on the host system with the privileges of the user running the CLI. This occurs in the file lib/commands/create.js where the variable pw is passed to the exec() function without validation, enabling shell metacharacters to break out of the intended command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-42853

GHSA-HCWQ-X9FW-8CFQ

Affected Products

@Apostrophecms/Cli

Apostrophe

References · 9

• 🔥 https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hcwq-x9fw-8cfq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42853.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42853 · Security Note
• https://osv.dev/vulnerability/GHSA-hcwq-x9fw-8cfq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42853 · Vendor Advisory
• https://github.com/apostrophecms/apostrophe · Note
• https://twitter.com/CVEnew/status/2066216173709021371 · Twitter Post
• https://twitter.com/infoflowcloud/status/2066216954717692083 · Twitter Post
• https://t.me/cveNotify/167309 · Telegram Post