5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33889

CVE-2026-33889: ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module, where color values prefixed with -- bypass TinyColor validation intended for CSS custom properties, and the launder.string() call performs only type coercion without stripping HTML metacharacters. These unsanitized values are then concatenated directly into <style> tags both in per-widget style elements rendered for all visitors and in the global stylesheet rendered for editors, with the output marked as safe HTML. An editor can inject a value which closes the style tag and executes arbitrary JavaScript in the browser of every visitor to any page containing the affected widget. This enables mass session hijacking, cookie theft, and privilege escalation to administrative control if an admin views draft content. This issue has been fixed in version 4.29.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33889

CVE-2026-33889:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
apostrophe	npm	< 4.29.0	4.29.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in ApostropheCMS, originating from the @apostrophecms/color-field module. The root cause is a two-part problem involving both improper input validation and a lack of output escaping.

First, the convert function within the @apostrophecms/color-field module intentionally bypasses validation for any string starting with --. This was intended to allow the use of CSS custom properties (variables), but it failed to sanitize the rest of the string. This allowed an editor to save a malicious payload, such as --x: red}</style><script>alert(document.cookie)</script><style>, into a color field. The system would store this payload in the database.

Second, when rendering pages, ApostropheCMS uses this stored value in two vulnerable ways:

The getWidgetElements function in the @apostrophecms/styles module injects per-widget styles directly into a <style> tag on the public-facing page. It did not escape the CSS content, allowing the injected </style> tag from the payload to close the style block prematurely and execute arbitrary JavaScript. This affects all site visitors.
The getHeadNodes function, also in @apostrophecms/styles, prepares the global stylesheet for authenticated users viewing draft pages. It placed the malicious payload into a raw node that the template engine would render unescaped, leading to XSS and potential session hijacking of higher-privileged users like administrators.

The patch addresses these issues by adding strict validation in the convert function to only allow valid CSS variable syntax and by adding output escaping in both getWidgetElements and getHeadNodes to neutralize any remaining malicious characters before rendering.

Vulnerable functions

convert

packages/apostrophe/modules/@apostrophecms/color-field/index.js

The `convert` function in the `@apostrophecms/color-field` module was responsible for validating color values. The vulnerability existed because it bypassed validation for any input starting with '--', assuming it was a legitimate CSS custom property. However, it performed no sanitization, allowing an attacker to inject a payload like '--x: red}</style><script>alert(1)</script><style>'. This malicious string would be stored in the database and later rendered on the page, causing a stored XSS.

getWidgetElements

packages/apostrophe/modules/@apostrophecms/styles/lib/methods.js

The `getWidgetElements` function in the `@apostrophecms/styles` module generates the HTML for widget-specific styles. It was vulnerable because it directly concatenated the CSS string, which could contain the malicious payload from the color field, into a `<style>` tag without any output escaping. This allowed an attacker to inject a closing `</style>` tag followed by arbitrary HTML and JavaScript, which would then be executed in the browser of any user viewing the page with the compromised widget.

getHeadNodes

packages/apostrophe/modules/@apostrophecms/styles/lib/methods.js

The `getHeadNodes` function in the `@apostrophecms/styles` module is responsible for adding nodes to the `<head>` of the HTML document, including the global stylesheet. The vulnerability existed because it took the content for the global stylesheet (`req.data.global.stylesStylesheet`) and placed it within a `raw` property, which is designed to be rendered without escaping by the template engine. When a malicious color value was saved, it would be included in this global stylesheet, and this function would fail to sanitize it before passing it to the renderer, leading to stored XSS for authenticated users viewing draft content.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.