CVE-2026-112958: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget wrapper’s style="..." attribute without HTML-attribute escaping.
An attacker who can edit the widget can include a double quote in the style value, terminate the style attribute, and inject new HTML event-handler attributes. The payload is stored with the widget and executes in the Apostrophe site origin whenever the affected published page is rendered.
This is a sibling of CVE-2026-33889 / GHSA-97v6-998m-fp4g. The earlier issue escaped from a <style> element through a malicious color value. This variant reaches a different sink related to the automatically generated widget wrapper’s inline style and class attributes.
References
- github.com/advisories/GHSA-7jg5-frgc-c67w
- github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
- github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
- github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0
- github.com/apostrophecms/apostrophe/security/advisories/GHSA-7jg5-frgc-c67w
- nvd.nist.gov/vuln/detail/CVE-2026-112958
Code Behaviors & Features
Detect and mitigate CVE-2026-112958 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →