Is CVE-2026-113659 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113659 being exploited in the wild.

How severe is CVE-2026-113659?

Medium severity, with a CVSS score of 6.1, published 20 October 2026.

Which products and versions are affected?

ApostropheCMS 4.0.0 through 4.32.2 (all 4.x releases), and 3.x; apostrophe (npm) < 4.33.0, SEMVER:introduced=0,fixed=4.33.0.

How is CVE-2026-113659 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-113659?

Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113659: ApostropheCMS client-side prototype pollution leading to DOM-based XSS

Q: Is there a fix for CVE-2026-113659?

Yes. apostrophe (npm): upgrade to 4.33.0 or later. Until then: Restrict authenticated account access to trusted users and educate administrators not to open untrusted links while logged into ApostropheCMS. There is no server-side configuration that disables the vulnerable client-side behavior. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-113659 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-113659?

Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113659 · Severity: medium · CVSS 6.1 · Published 2026-10-20

ApostropheCMS, a web content management system, has a vulnerability in how it parses URL query strings on the client side that allows an attacker to inject arbitrary properties into JavaScript objects. When a logged-in administrator or editor visits a malicious link, this vulnerability can be exploited to run malicious code in their browser session, potentially allowing account takeover or modification of website content.

Technologies: ApostropheCMS, apostrophe (npm). Vendors: ApostropheCMS, npm.

Quick answers

Is CVE-2026-113659 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113659 being exploited in the wild.
How severe is CVE-2026-113659?: Medium severity, with a CVSS score of 6.1, published 20 October 2026.
Which products and versions are affected?: ApostropheCMS 4.0.0 through 4.32.2 (all 4.x releases), and 3.x; apostrophe (npm) < 4.33.0, SEMVER:introduced=0,fixed=4.33.0.
Is there a fix for CVE-2026-113659?: Yes. apostrophe (npm): upgrade to 4.33.0 or later. Until then: Restrict authenticated account access to trusted users and educate administrators not to open untrusted links while logged into ApostropheCMS. There is no server-side configuration that disables the vulnerable client-side behavior. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113659 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-113659?: Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apostrophe (npm): upgrade to 4.33.0 or later
```
npm install apostrophe@4.33.0
```

Restrict authenticated account access to trusted users and educate administrators not to open untrusted links while logged into ApostropheCMS. There is no server-side configuration that disables the vulnerable client-side behavior.

Technical details

The `apos.http.parseQuery()` function fails to sanitize the keys `__proto__`, `constructor`, and `prototype` when parsing URL query strings, allowing an attacker to write arbitrary properties onto `Object.prototype`. The admin context bar's `data()` initializer processes `window.location.search` on every authenticated page load without validation. Vue's element-mount routine then enumerates inherited properties from the polluted prototype and writes them to the DOM, causing prototype pollution to escalate to DOM-based XSS. An attacker must trick an authenticated user into opening a crafted URL.

Affected products

ApostropheCMS ApostropheCMS 4.0.0 through 4.32.2 (all 4.x releases), and 3.x

Identifiers

CVE-2026-113659
GHSA-m2m5-rw3w-cwmj

Timeline

2026-10-20: disclosed: GHSA-m2m5-rw3w-cwmj published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.