ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
Summary
The color field accepts any string that begins with a valid rgb() / hsl() color, because TinyColor.isValid does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered, the payload executes, resulting in stored cross-site scripting (XSS).
Details
Server-side validation of the color field relies on TinyColor:
const { TinyColor } = require('@ctrl/tinycolor');
if (!new TinyColor(value).isValid) throw self.apos.error('invalid');TinyColor's rgb/hsl matchers are not anchored at the end of the string, while hex matchers are. Tested with @ctrl/tinycolor:
| Input | isValid |
|---|---|
rgb(1,2,3)<img src=x onerror=alert(1)> |
true |
rgb(1,2,3)</textarea><script>alert(1)</script> |
true |
hsl(0,100%,50%);--x:1}</style><script>alert(1)</script> |
true |
#ff0000<img src=x onerror=alert(1)> |
false |
The value is saved to MongoDB unchanged (not normalized to hex8).
Relation to GHSA-97v6-998m-fp4g
GHSA-97v6 addressed CSS custom property injection escaping a <style> context. The root cause (validation that accepts trailing content after a valid color) still exists in <= 4.32.2, so either the style-tag sink remains exploitable via </style> or a separate HTML sink is exploitable. Fixing the validation (requiring the full string to be a color, or storing only TinyColor's normalized output) would close both.
Impact
Any user with edit permission can plant persistent JavaScript that runs in the browser of visitors and administrators viewing the affected page, enabling session hijacking and actions as an admin.
Suggested fix
Reject values unless the entire string is a valid color, e.g. normalize on save:
const c = new TinyColor(value);
if (!c.isValid) throw self.apos.error('invalid');
value = c.toHex8String(); // store only normalized outputWhat to do
Upgrade to ApostropheCMS version 4.34.0 or later.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | apostrophe | < 4.34.0 | 4.34.0 |
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmgj-9cwm-cf3h
- https://nvd.nist.gov/vuln/detail/CVE-2026-112951
- https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
- https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
- https://github.com/apostrophecms/apostrophe
- https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
apostrophe- Disclosed
- 21.10.2026
- Updated
- 21.10.2026 20:21
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-vmgj-9cwm-cf3h - CC BY 4.0
Vulnerability history: apostrophe
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 33
- First → latest
- 09.2020 10.2026
- Without a fix
- 4
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 9
- Medium 18
- Low 4
Disclosures per year
- 2020: 2
- 2021: 2
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 29
-
ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.