{"id":"ghsa-ghsa-m2m5-rw3w-cwmj","seq":2414,"kind":"advisory","title":"ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users","url":"https://github.com/advisories/GHSA-m2m5-rw3w-cwmj","permalink":"https://vulnpulse.app/items/ghsa-ghsa-m2m5-rw3w-cwmj","summary":"影響: npm:apostrophe < 4.33.0 → 4.33.0\nSummary The client-side helper apos.http.parseQuery() in ApostropheCMS builds a nested object from a URL query string without sanitizing the keys __proto__, constructor, or prototype. Parsing an attacker-controlled query string therefore writes arbitrary properties onto Object.prototype (client-side prototype pollution). ApostropheCMS's admin UI calls this parser with window.location.search on every authenticated page load (the admin context bar's data() initializer). Because the admin UI is bu…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-113659"],"tags":["GHSA-m2m5-rw3w-cwmj","apostrophe"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:18:49.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}