CVE-2026-33889

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module, where color values prefixed with -- bypass TinyColor validation intended for CSS custom properties, and the launder.string() call performs only type coercion without stripping HTML metacharacters. These unsanitized values are then concatenated directly into <style> tags both in per-widget style elements rendered for all visitors and in the global stylesheet rendered for editors, with the output marked as safe HTML. An editor can inject a value which closes the style tag and executes arbitrary JavaScript in the browser of every visitor to any page containing the affected widget. This enables mass session hijacking, cookie theft, and privilege escalation to administrative control if an admin views draft content. This issue has been fixed in version 4.29.0.

• CWE-79

• https://github.com/apostrophecms/apostrophe/commit/6a89bdb7acdb2e1e9bf1429961a6ba7f99410481Patch
• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97v6-998m-fp4gExploit, Mitigation, Vendor Advisory
• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97v6-998m-fp4gExploit, Mitigation, Vendor Advisory

Published

Apr 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33883Statamic is a Laravel and Git powered content management sys…6.1
• CVE-2026-33884Statamic is a Laravel and Git powered content management sys…4.3
• CVE-2026-33885Statamic is a Laravel and Git powered content management sys…6.1
• CVE-2026-33886Statamic is a Laravel and Git powered content management sys…6.5
• CVE-2026-33887Statamic is a Laravel and Git powered content management sys…5.4
• CVE-2026-33888ApostropheCMS is an open-source Node.js content management s…5.3
• CVE-2026-3389A vulnerability was determined in Squirrel up to 3.2. This v…5.5
• CVE-2026-33890MyTube is a self-hosted downloader and player for several vi…9.8
• CVE-2026-33891Forge (also called `node-forge`) is a native implementation …7.5
• CVE-2026-33892A vulnerability has been identified in Industrial Edge Manag…7.1
• CVE-2026-33893A vulnerability has been identified in Teamcenter V2312 (All…8.7
• CVE-2026-33894Forge (also called `node-forge`) is a native implementation …7.5