All vulnerabilities
CVE-2026-71553GHSA-vmg4-6gfg-83qx

ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

apostrophecms apostrophenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 37% of CVEs. Scored 28 Oct 2026FIRST EPSS
Fixed in4.32.1Fixed versionGitHub
Published17 Aug 2026Updated 28 Oct 2026CVE List

What fixes it

  • 4.32.1apostrophe, npmGitHubnpm install apostrophe@4.32.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/<id>" with a valid editor session and body of {"toString.call":"x"}, overwriting the global toString function with value x.

Fabian

Text from GitHub Advisory Database

Affected versions 3

  • apostrophe, npm<= 4.32.0GitHub
  • apostropheaffected: <= 4.32.0CVE List
  • apostrophe, npmfrom first release, through 4.32.0OSV

References 4