## ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-112951
- 公開日時: 2026-10-21T17:05:44.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-vmgj-9cwm-cf3h)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-vmgj-9cwm-cf3h

影響: npm:apostrophe < 4.34.0 → 4.34.0
Summary The color field accepts any string that begins with a valid rgb() / hsl() color, because TinyColor.isValid does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered , the payload executes, resulting in stored XSS. Details Server-side validation of the color field relies on TinyColor: js const { TinyColor } = require('@ctrl/tinycolor'); if (!new TinyColor(value).isValid…