CVE-2026-113659

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special proto, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session; anonymous visitors do not load the affected admin context. This issue is fixed in version 4.33.0.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special proto, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session; anonymous visitors do not load the affected admin context. This issue is fixed in version 4.33.0.

Summary

The client-side helper apos.http.parseQuery() in ApostropheCMS builds a nested object from a URL query string without sanitizing the keys __proto__, constructor, or prototype. Parsing an attacker-controlled query string therefore writes arbitrary properties onto Object.prototype (client-side prototype pollution).

ApostropheCMS's admin UI calls this parser with window.location.search on every authenticated page load (the admin context bar's data() initializer). Because the admin UI is built on Vue, a polluted, enumerable property on Object.prototype is then picked up by Vue's standard element-mount routine and written to the DOM as an element property, turning the prototype pollution into DOM-based XSS in the victim's authenticated session. The escalation gadget is a well-known, general Vue behavior; the novel, reportable defect is the unsanitized parseQuery source together with the authenticated trigger, both of which are ApostropheCMS code.

Any user who can get any logged-in user (from the lowest-privileged guest role up to the highest-privileged admin role) to open a crafted URL can execute arbitrary JavaScript in that user's session.

This is distinct from CVE-2026-53609 (server-side prototype pollution via apos.util.set() / $pullAll, fixed in 4.31.0): different side (client vs server), different code path, and the vulnerable code here is present in the current release.

Package

• Ecosystem: npm
• Package: apostrophe
• Affected versions: all 4.x releases, 4.0.0 through 4.32.2 (current latest). Verified by inspecting the published npm tarballs: [email protected] already contains the vulnerable descent (parentKey = 'root') with no __proto__/constructor/prototype filtering, and [email protected] is unchanged in this respect. The vulnerable parseQuery() logic was introduced in commit 0255086bf (2020-11-12), well before the 4.0 version, so ApostropheCMS 3.x is also affected (the same code ships in 3.x at the older build path modules/@apostrophecms/util/ui/public/2-http.js).
• Patched versions: none at time of writing.

Details

The issue has three parts. Parts 1 and 2 are ApostropheCMS code and constitute the reportable vulnerability. Part 3 is the escalation gadget, which is standard Vue behavior and is included for completeness.

1. The pollution primitive: source (ApostropheCMS)

modules/@apostrophecms/util/ui/src/http.js, function apos.http.parseQuery() (line ~301) and its inner patch() (lines ~317–354):

function patch(key, value) {
  let match;
  let parentKey = 'root';
  let context = data;                    // data = {}  (ordinary object)
  key = decodeURIComponent(key);
  const path = key.split('[');
  path.forEach(function(subKey) {
    if (subKey === ']') {
      /* array handling */
    } else if (subKey.match(/^\d+]/)) {
      /* numeric index handling */
    } else {
      match = subKey.replace(']', '');
      if (!context[parentKey]) {         // (A) truthy check, not an own-property check
        context[parentKey] = {};
      }
      context = context[parentKey];      // (B) descends into whatever this resolves to
      parentKey = match;
    }
  });
  value = (value === null) ? value : decodeURIComponent(value);
  if (Array.isArray(context[parentKey])) {
    context[parentKey].push(value);
  } else if (context[parentKey] !== undefined) {
    context[parentKey] = [ context[parentKey], value ];
  } else {
    context[parentKey] = value;          // (C) assignment onto the resolved object
  }
}

No __proto__, constructor, or prototype key is rejected. Walking the input __proto__[x]=v:

1. Segment __proto__: at (A), context['__proto__'] resolves to the object's inherited prototype (truthy), so the {} initializer is skipped; at (B), context becomes Object.prototype.
2. Segment x: at (C), Object.prototype['x'] = v.

The truthy guard at…

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special proto, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session; anonymous visitors do not load the affected admin context. This issue is fixed in version 4.33.0.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special proto, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session; anonymous visitors do not load the affected admin context. This issue is fixed in version 4.33.0.

Summary

The client-side helper apos.http.parseQuery() in ApostropheCMS builds a nested object from a URL query string without sanitizing the keys __proto__, constructor, or prototype. Parsing an attacker-controlled query string therefore writes arbitrary properties onto Object.prototype (client-side prototype pollution).

ApostropheCMS's admin UI calls this parser with window.location.search on every authenticated page load (the admin context bar's data() initializer). Because the admin UI is built on Vue, a polluted, enumerable property on Object.prototype is then picked up by Vue's standard element-mount routine and written to the DOM as an element property, turning the prototype pollution into DOM-based XSS in the victim's authenticated session. The escalation gadget is a well-known, general Vue behavior; the novel, reportable defect is the unsanitized parseQuery source together with the authenticated trigger, both of which are ApostropheCMS code.

Any user who can get any logged-in user (from the lowest-privileged guest role up to the highest-privileged admin role) to open a crafted URL can execute arbitrary JavaScript in that user's session.

This is distinct from CVE-2026-53609 (server-side prototype pollution via apos.util.set() / $pullAll, fixed in 4.31.0): different side (client vs server), different code path, and the vulnerable code here is present in the current release.

Package

• Ecosystem: npm
• Package: apostrophe
• Affected versions: all 4.x releases, 4.0.0 through 4.32.2 (current latest). Verified by inspecting the published npm tarballs: [email protected] already contains the vulnerable descent (parentKey = 'root') with no __proto__/constructor/prototype filtering, and [email protected] is unchanged in this respect. The vulnerable parseQuery() logic was introduced in commit 0255086bf (2020-11-12), well before the 4.0 version, so ApostropheCMS 3.x is also affected (the same code ships in 3.x at the older build path modules/@apostrophecms/util/ui/public/2-http.js).
• Patched versions: none at time of writing.

Details

The issue has three parts. Parts 1 and 2 are ApostropheCMS code and constitute the reportable vulnerability. Part 3 is the escalation gadget, which is standard Vue behavior and is included for completeness.

1. The pollution primitive: source (ApostropheCMS)

modules/@apostrophecms/util/ui/src/http.js, function apos.http.parseQuery() (line ~301) and its inner patch() (lines ~317–354):

function patch(key, value) {
  let match;
  let parentKey = 'root';
  let context = data;                    // data = {}  (ordinary object)
  key = decodeURIComponent(key);
  const path = key.split('[');
  path.forEach(function(subKey) {
    if (subKey === ']') {
      /* array handling */
    } else if (subKey.match(/^\d+]/)) {
      /* numeric index handling */
    } else {
      match = subKey.replace(']', '');
      if (!context[parentKey]) {         // (A) truthy check, not an own-property check
        context[parentKey] = {};
      }
      context = context[parentKey];      // (B) descends into whatever this resolves to
      parentKey = match;
    }
  });
  value = (value === null) ? value : decodeURIComponent(value);
  if (Array.isArray(context[parentKey])) {
    context[parentKey].push(value);
  } else if (context[parentKey] !== undefined) {
    context[parentKey] = [ context[parentKey], value ];
  } else {
    context[parentKey] = value;          // (C) assignment onto the resolved object
  }
}

No __proto__, constructor, or prototype key is rejected. Walking the input __proto__[x]=v:

1. Segment __proto__: at (A), context['__proto__'] resolves to the object's inherited prototype (truthy), so the {} initializer is skipped; at (B), context becomes Object.prototype.
2. Segment x: at (C), Object.prototype['x'] = v.

The truthy guard at…