## ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-112958
- 公開日時: 2026-10-21T17:15:07.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-7jg5-frgc-c67w)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-7jg5-frgc-c67w

影響: npm:apostrophe < 4.34.0 → 4.34.0
Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget wrapper's style="..." attribute without HTML-attribute escaping. An attacker who can edit the widget can include a double quote in the style value, terminate the style attribute, and inject new HTML event-ha…