# CVE-2026-113659: ApostropheCMS client-side prototype pollution leading to DOM-based XSS

Source: https://junglewise.ai/threats/cve-2026-113659-apostrophecms-client-side-prototype-pollution-in-apos-http  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113659 · Severity: medium · CVSS 6.1 · Published 2026-10-20

ApostropheCMS, a web content management system, has a vulnerability in how it parses URL query strings on the client side that allows an attacker to inject arbitrary properties into JavaScript objects. When a logged-in administrator or editor visits a malicious link, this vulnerability can be exploited to run malicious code in their browser session, potentially allowing account takeover or modification of website content.

Technologies: [ApostropheCMS](https://junglewise.ai/threats/technologies/apostrophecms), [apostrophe (npm)](https://junglewise.ai/threats/technologies/apostrophe). Vendors: [ApostropheCMS](https://junglewise.ai/threats/vendors/apostrophecms), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-113659 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113659 being exploited in the wild.

**How severe is CVE-2026-113659?** Medium severity, with a CVSS score of 6.1, published 20 October 2026.

**Which products and versions are affected?** ApostropheCMS 4.0.0 through 4.32.2 (all 4.x releases), and 3.x; apostrophe (npm) < 4.33.0, SEMVER:introduced=0,fixed=4.33.0.

**Is there a fix for CVE-2026-113659?** Yes. apostrophe (npm): upgrade to 4.33.0 or later. Until then: Restrict authenticated account access to trusted users and educate administrators not to open untrusted links while logged into ApostropheCMS. There is no server-side configuration that disables the vulnerable client-side behavior. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113659 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-113659?** Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apostrophe (npm): upgrade to 4.33.0 or later

  ```sh
  npm install apostrophe@4.33.0
  ```


Restrict authenticated account access to trusted users and educate administrators not to open untrusted links while logged into ApostropheCMS. There is no server-side configuration that disables the vulnerable client-side behavior.

## Technical details

The `apos.http.parseQuery()` function fails to sanitize the keys `__proto__`, `constructor`, and `prototype` when parsing URL query strings, allowing an attacker to write arbitrary properties onto `Object.prototype`. The admin context bar's `data()` initializer processes `window.location.search` on every authenticated page load without validation. Vue's element-mount routine then enumerates inherited properties from the polluted prototype and writes them to the DOM, causing prototype pollution to escalate to DOM-based XSS. An attacker must trick an authenticated user into opening a crafted URL.

## Affected products

- ApostropheCMS ApostropheCMS 4.0.0 through 4.32.2 (all 4.x releases), and 3.x

## Identifiers

- CVE-2026-113659
- GHSA-m2m5-rw3w-cwmj

## Timeline

- 2026-10-20: disclosed: GHSA-m2m5-rw3w-cwmj published

## Related threats

- [ApostropheCMS unauthenticated file upload in import routes](https://junglewise.ai/threats/cve-2026-113711-apostrophecms-is-an-open-source-node-js-content-management)
- [ApostropheCMS password-change endpoint lacks attempt throttling](https://junglewise.ai/threats/cve-2026-113710-apostrophecms-no-attempt-throttling-on-authenticated-password)
- [ApostropheCMS page REST API authorization bypass](https://junglewise.ai/threats/cve-2026-113670-apostrophecms-page-rest-api-authorization-bypass)
- [ApostropheCMS cross-domain session token in URL confers session takeover](https://junglewise.ai/threats/cve-2026-113669-apostrophecms-cross-domain-session-token-in-url-confers-session)
- [ApostropheCMS REST route authorization bypass in locales endpoint](https://junglewise.ai/threats/cve-2026-113668-apostrophecms-id-locales-rest-route-omits-the-public-api)