## ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-113659
- 公開日時: 2026-10-20T18:18:49.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-m2m5-rw3w-cwmj)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-m2m5-rw3w-cwmj

影響: npm:apostrophe < 4.33.0 → 4.33.0
Summary The client-side helper apos.http.parseQuery() in ApostropheCMS builds a nested object from a URL query string without sanitizing the keys __proto__, constructor, or prototype. Parsing an attacker-controlled query string therefore writes arbitrary properties onto Object.prototype (client-side prototype pollution). ApostropheCMS's admin UI calls this parser with window.location.search on every authenticated page load (the admin context bar's data() initializer). Because the admin UI is bu…