CVE-2026-33889: ApostropheCMS stored XSS in color-field CSS custom properties

Executive brief

ApostropheCMS, a content management system, contains a vulnerability where website editors can inject malicious scripts into the site's styles. These scripts are then executed in the browsers of all site visitors and administrators. This could allow an attacker to steal user sessions, hijack accounts, or deface the website.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the @apostrophecms/color-field module of ApostropheCMS. The root cause is a validation bypass in the 'convert' method which exempts values starting with '--' (intended for CSS custom properties) from validation without performing HTML sanitization. When these values are rendered into <style> tags in widget or global styles, an authenticated editor can inject a '</style>' sequence to break out of the CSS context and execute arbitrary JavaScript. This affects both public-facing pages and administrative draft views. The vulnerability is patched in version 4.29.0.

Affected products

• ApostropheCMS apostrophe < 4.29.0

Timeline

• 2026-04-15: disclosed
• 2026-04-16: advisory: GHSA-97v6-998m-fp4g published

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D