{"id":"ghsa-ghsa-7jg5-frgc-c67w","seq":32730,"kind":"advisory","title":"ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization","url":"https://github.com/advisories/GHSA-7jg5-frgc-c67w","permalink":"https://vulnpulse.app/items/ghsa-ghsa-7jg5-frgc-c67w","summary":"影響: npm:apostrophe < 4.34.0 → 4.34.0\nSummary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget wrapper's style=\"...\" attribute without HTML-attribute escaping. An attacker who can edit the widget can include a double quote in the style value, terminate the style attribute, and inject new HTML event-ha…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-112958"],"tags":["GHSA-7jg5-frgc-c67w","apostrophe"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T17:15:07.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}