{"id":"ghsa-ghsa-vmgj-9cwm-cf3h","seq":32733,"kind":"advisory","title":"ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix","url":"https://github.com/advisories/GHSA-vmgj-9cwm-cf3h","permalink":"https://vulnpulse.app/items/ghsa-ghsa-vmgj-9cwm-cf3h","summary":"影響: npm:apostrophe < 4.34.0 → 4.34.0\nSummary The color field accepts any string that begins with a valid rgb() / hsl() color, because TinyColor.isValid does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered , the payload executes, resulting in stored XSS. Details Server-side validation of the color field relies on TinyColor: js const { TinyColor } = require('@ctrl/tinycolor'); if (!new TinyColor(value).isValid…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-112951"],"tags":["GHSA-vmgj-9cwm-cf3h","apostrophe"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T17:05:44.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}