Is CVE-2026-113662 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113662 being exploited in the wild.

How severe is CVE-2026-113662?

Medium severity, with a CVSS score of 5.4, published 20 October 2026.

Which products and versions are affected?

ApostropheCMS @Apostrophecms/Import-Export main branch as of 2026-09-04; @apostrophecms/import-export (npm) < 3.7.0, SEMVER:introduced=0,fixed=3.7.0.

How is CVE-2026-113662 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-113662?

Check whether you run ApostropheCMS @Apostrophecms/Import-Export or @apostrophecms/import-export (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113662: ApostropheCMS import-export NoSQL injection in update-key

Q: Is there a fix for CVE-2026-113662?

Yes. @apostrophecms/import-export (npm): upgrade to 3.7.0 or later. Until then: Launder the update-key value to a plain string before using it in MongoDB queries, mirroring the fix already applied to other fields in GHSA-79qf-vqgc-7xx3, and fall back to insert mode if the update-key is not a valid string. [{"kind": "disclosed", "at": "2026-10-20"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-113662 · Severity: medium · CVSS 5.4 · Published 2026-10-20

ApostropheCMS is a headless CMS platform that manages web content. The import-export module's update-key feature allows an attacker with contributor role to inject NoSQL operators into import files, causing the system to match and overwrite arbitrary documents the attacker shouldn't have access to. This could lead to unauthorized content modification or data loss.

Technologies: ApostropheCMS @Apostrophecms/Import-Export, @apostrophecms/import-export (npm). Vendors: ApostropheCMS, npm.

Quick answers

Is CVE-2026-113662 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113662 being exploited in the wild.
How severe is CVE-2026-113662?: Medium severity, with a CVSS score of 5.4, published 20 October 2026.
Which products and versions are affected?: ApostropheCMS @Apostrophecms/Import-Export main branch as of 2026-09-04; @apostrophecms/import-export (npm) < 3.7.0, SEMVER:introduced=0,fixed=3.7.0.
Is there a fix for CVE-2026-113662?: Yes. @apostrophecms/import-export (npm): upgrade to 3.7.0 or later. Until then: Launder the update-key value to a plain string before using it in MongoDB queries, mirroring the fix already applied to other fields in GHSA-79qf-vqgc-7xx3, and fall back to insert mode if the update-key is not a valid string.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-20"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113662 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-113662?: Check whether you run ApostropheCMS @Apostrophecms/Import-Export or @apostrophecms/import-export (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@apostrophecms/import-export (npm): upgrade to 3.7.0 or later
```
npm install @apostrophecms/import-export@3.7.0
```

Launder the update-key value to a plain string before using it in MongoDB queries, mirroring the fix already applied to other fields in GHSA-79qf-vqgc-7xx3, and fall back to insert mode if the update-key is not a valid string.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-20"}]

Technical details

A NoSQL injection vulnerability exists in the update-key matching logic (insertOrUpdateDocWithKey in lib/methods/import.js) where MongoDB operators like {$ne: null} embedded in import archive files bypass validation. The EJSON parser revives these objects as live values without sanitization, allowing an authenticated attacker with import permissions to target any document satisfying the operator condition rather than a specifically identified document. The vulnerability affects any field used with the :key suffix in imports.

Affected products

ApostropheCMS @apostrophecms/import-export main branch as of 2026-09-04

Identifiers

CVE-2026-113662
GHSA-jqw5-w6h3-44g6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.