Quick answers
- Is CVE-2026-33889 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-33889 being exploited in the wild.
- How severe is CVE-2026-33889?
- Medium severity, with a CVSS score of 5.4, published 15 April 2026.
- Which products and versions are affected?
- ApostropheCMS < 4.29.0; apostrophe (npm) < 4.29.0, SEMVER:introduced=0,fixed=4.29.0.
- Is there a fix for CVE-2026-33889?
- Yes. apostrophe (npm): upgrade to 4.29.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-33889 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-33889?
- Check whether you run ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- apostrophe (npm): upgrade to 4.29.0 or later
npm install apostrophe@4.29.0
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the @apostrophecms/color-field module of ApostropheCMS. The root cause is a validation bypass in the 'convert' method which exempts values starting with '--' (intended for CSS custom properties) from validation without performing HTML sanitization. When these values are rendered into <style> tags in widget or global styles, an authenticated editor can inject a '</style>' sequence to break out of the CSS context and execute arbitrary JavaScript. This affects both public-facing pages and administrative draft views. The vulnerability is patched in version 4.29.0.
Affected products
- ApostropheCMS apostrophe < 4.29.0
Identifiers
- CVE-2026-33889
- GHSA-97v6-998m-fp4g
Timeline
- 2026-04-15: disclosed
- 2026-04-16: advisory: GHSA-97v6-998m-fp4g published