ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

影響: npm:apostrophe < 4.34.0 → 4.34.0 Summary The color field accepts any string that begins with a valid rgb() / hsl() color, because TinyColor.isValid does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered , the payload executes, resulting in stored XSS. Details Server-side validation of the color field relies on TinyColor: js const { TinyColor } = require('@ctrl/tinycolor'); if (!new TinyColor(value).isValid…

GitHub Advisory Databaseで読む