HIGH

GHSA-vmg4-6gfg-83qx

ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

Details

The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/<id>" with a valid editor session and body of {"toString.call":"x"}, overwriting the global toString function with value x.

Fabian

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/apostrophe

Introduced in: 0

No fixed version published yet for apostrophe (npm). Pin to a known-safe version or switch to an alternative.

References

https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmg4-6gfg-83qx[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-71553[ADVISORY]
https://github.com/apostrophecms/apostrophe/commit/5a3746aaed49761e171c2cbfe793267c959829fd[WEB]
https://github.com/apostrophecms/apostrophe[PACKAGE]