Is CVE-2026-113671 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113671 being exploited in the wild.

How severe is CVE-2026-113671?

Medium severity, with a CVSS score of 4.3, published 20 October 2026.

Which products and versions are affected?

ApostropheCMS Ai-Helper 1.0.0-beta.10 through 1.0.0-beta.12; @apostrophecms/ai-helper (npm) >= 1.0.0-beta.10, < 1.0.0-beta.13, SEMVER:introduced=1.0.0-beta.10,fixed=1.0.0-beta.13.

How is CVE-2026-113671 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-113671?

Check whether you run ApostropheCMS Ai-Helper or @apostrophecms/ai-helper (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113671: ApostropheCMS ai-helper SSRF via Host header in image fetch

Q: Is there a fix for CVE-2026-113671?

Yes. @apostrophecms/ai-helper (npm): upgrade to 1.0.0-beta.13 or later. Until then: Configure a global base URL (apos.baseUrl) so the resolved origin is fixed and not derived from the HTTP Host header. Additionally, place egress controls on the server to prevent outbound requests from reaching sensitive internal hosts or cloud metadata endpoints. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-113671 · Severity: medium · CVSS 4.3 · Published 2026-10-20

ApostropheCMS ai-helper is a plugin that generates AI-powered images for a content management system. An authenticated editor can trick the server into making outbound HTTP requests to internal networks or cloud metadata endpoints by supplying a crafted Host header when accepting an AI-generated image, allowing probing of internal services and limited data exfiltration that would otherwise be unreachable from the attacker's network position.

Vendors: ApostropheCMS, npm.

Quick answers

Is CVE-2026-113671 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113671 being exploited in the wild.
How severe is CVE-2026-113671?: Medium severity, with a CVSS score of 4.3, published 20 October 2026.
Which products and versions are affected?: ApostropheCMS Ai-Helper 1.0.0-beta.10 through 1.0.0-beta.12; @apostrophecms/ai-helper (npm) >= 1.0.0-beta.10, < 1.0.0-beta.13, SEMVER:introduced=1.0.0-beta.10,fixed=1.0.0-beta.13.
Is there a fix for CVE-2026-113671?: Yes. @apostrophecms/ai-helper (npm): upgrade to 1.0.0-beta.13 or later. Until then: Configure a global base URL (apos.baseUrl) so the resolved origin is fixed and not derived from the HTTP Host header. Additionally, place egress controls on the server to prevent outbound requests from reaching sensitive internal hosts or cloud metadata endpoints.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113671 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-113671?: Check whether you run ApostropheCMS Ai-Helper or @apostrophecms/ai-helper (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@apostrophecms/ai-helper (npm): upgrade to 1.0.0-beta.13 or later
```
npm install @apostrophecms/ai-helper@1.0.0-beta.13
```

Configure a global base URL (apos.baseUrl) so the resolved origin is fixed and not derived from the HTTP Host header. Additionally, place egress controls on the server to prevent outbound requests from reaching sensitive internal hosts or cloud metadata endpoints.</anigation> </invoke>

Technical details

The ai-helper-image module constructs a fetch URL by resolving a relative storage path against req.baseUrl, which defaults to the HTTP Host header when no global base URL is configured. An authenticated attacker generates a base64 image (stored without a URL) and sends a PATCH accept request with an attacker-controlled Host header. The accept route performs no authorization check (unlike the generate route) and no validation on the resolved origin, so the server issues a GET request to the attacker-specified host and port at the fixed path /uploads/ai-helper-images/<id>.png, enabling SSRF to internal or metadata endpoints.

Affected products

ApostropheCMS ai-helper 1.0.0-beta.10 through 1.0.0-beta.12

Identifiers

CVE-2026-113671
GHSA-527g-ff96-x6wj

Timeline

2026-10-20: disclosed: Vulnerability published via GHSA advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.