CVE-2026-45011

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45011
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45011.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45011
Aliases
Published
2026-06-12T20:43:18.939Z
Modified
2026-07-08T08:09:37.513699262Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Apostrophe has stored XSS via javascript: URL in Image Widget Link
Details

ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the live site. When another user, including an administrator or public visitor, clicks the affected image/link, arbitrary JavaScript executes in the victim’s browser. As of time of publication, no known patched versions are available.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45011.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-116",
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/apostrophecms/apostrophe

Affected ranges

Type
GIT
Repo
https://github.com/apostrophecms/apostrophe
Events
Introduced
96cf174486e1387948e189786c2d574cf7c3f3d0
Fixed
96cf174486e1387948e189786c2d574cf7c3f3d0
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "= 4.29.0"
        },
        {
            "last_affected": "= 4.29.0"
        }
    ]
}

Affected versions

= 4.*
= 4.29.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45011.json"