CVE-2026-112951: ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

The color field accepts any string that begins with a valid rgb() / hsl() color, because TinyColor.isValid does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered , the payload executes, resulting in stored XSS.