CVE-2026-113659: ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

The client-side helper apos.http.parseQuery() in ApostropheCMS builds a nested object from a URL query string without sanitizing the keys __proto__, constructor, or prototype. Parsing an attacker-controlled query string therefore writes arbitrary properties onto Object.prototype (client-side prototype pollution).

ApostropheCMS’s admin UI calls this parser with window.location.search on every authenticated page load (the admin context bar’s data() initializer). Because the admin UI is built on Vue, a polluted, enumerable property on Object.prototype is then picked up by Vue’s standard element-mount routine and written to the DOM as an element property, turning the prototype pollution into DOM-based XSS in the victim’s authenticated session. The escalation gadget is a well-known, general Vue behavior; the novel, reportable defect is the unsanitized parseQuery source together with the authenticated trigger, both of which are ApostropheCMS code.

Any user who can get any logged-in user (from the lowest-privileged guest role up to the highest-privileged admin role) to open a crafted URL can execute arbitrary JavaScript in that user’s session.

This is distinct from CVE-2026-53609 (server-side prototype pollution via apos.util.set() / $pullAll, fixed in 4.31.0): different side (client vs server), different code path, and the vulnerable code here is present in the current release.