apostrophe (npm)
Advisories
36
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.34.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install apostrophe@4.34.0yarn
yarn add apostrophe@4.34.0pnpm
pnpm add apostrophe@4.34.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-86wm-68pq-5jwq ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export |
High EPSS 0.56% |
< 4.33.0 | 4.33.0 |
| GHSA-653j-g8j7-gh54 ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing |
Medium EPSS 0.33% |
< 4.33.0 | 4.33.0 |
| GHSA-vwwx-px9w-crrc ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints |
Low EPSS 0.35% |
< 4.33.0 | 4.33.0 |
| GHSA-vmxh-77cw-65j7 ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers |
Medium EPSS 0.36% |
< 4.33.0 | 4.33.0 |
| GHSA-m2m5-rw3w-cwmj ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users |
Medium EPSS 0.34% |
< 4.33.0 | 4.33.0 |
| GHSA-gqh3-7856-rjjg ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) |
Medium EPSS 0.32% |
< 4.33.0 | 4.33.0 |
| GHSA-hhvr-8m24-qqr3 ApostropheCMS: Cross-domain session token in URL confers session takeover |
Medium EPSS 0.42% |
< 4.33.0 | 4.33.0 |
| GHSA-j5rq-xfvr-p969 ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service |
High EPSS 0.44% |
< 4.33.0 | 4.33.0 |
| GHSA-qhcq-9pm2-c9w9 ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory |
High EPSS 0.61% |
< 4.33.0 | 4.33.0 |
| GHSA-2jrp-qc93-h2j8 ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization |
Medium EPSS 0.32% |
< 4.33.0 | 4.33.0 |
| GHSA-xf6w-q65w-4f2w ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) |
Medium EPSS 0.39% |
< 4.33.0 | 4.33.0 |
| GHSA-5m22-7pfq-vp65 ApostropheCMS: Import API bypasses publication roles for protected content |
Medium EPSS 0.30% |
< 4.34.0 | 4.34.0 |
| GHSA-7jg5-frgc-c67w ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization |
Medium EPSS 0.30% |
< 4.34.0 | 4.34.0 |
| GHSA-vh56-5m88-39rq ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users |
Medium EPSS 0.31% |
< 4.34.0 | 4.34.0 |
| GHSA-rqgm-cfrp-4hx8 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API |
Medium EPSS 0.44% |
< 4.34.0 | 4.34.0 |
| GHSA-f66c-mpj2-3r8h ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user |
Medium EPSS 0.33% |
< 4.34.0 | 4.34.0 |
| GHSA-vmgj-9cwm-cf3h ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix |
Medium EPSS 0.30% |
< 4.34.0 | 4.34.0 |
| GHSA-2j32-q6rx-h844 ApostropheCMS: Page REST API authorization bypass |
Medium EPSS 0.30% |
< 4.33.0 | 4.33.0 |
| GHSA-vmg4-6gfg-83qx ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS |
High EPSS 0.43% |
< 4.32.1 | 4.32.1 |
| GHSA-vmg4-6gfg-83qx ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS |
High EPSS 0.43% |
<= 4.32.0 | No fix yet |
| GHSA-wr5r-wqp2-x4fh ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree |
Medium EPSS 0.31% |
< 4.32.0 | 4.32.0 |
| GHSA-6h5j-32cf-4253 Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass |
Critical EPSS 0.35% |
< 4.31.0 | 4.31.0 |
| GHSA-34pj-2622-jvxq @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header |
Low EPSS 0.27% |
< 4.31.0 | 4.31.0 |
| GHSA-5f64-7vfc-rcx6 Apostrophe has stored XSS via javascript: URL in Image Widget Link |
High EPSS 0.27% |
No fix yet | |
| GHSA-gf43-24g3-5hw2 Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation |
High EPSS 0.30% |
<= 4.29.0 | No fix yet |
| GHSA-pr28-mf3q-qpg6 Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget |
High EPSS 0.24% |
<= 4.29.0 | No fix yet |
| GHSA-c276-fj82-f2pq ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions |
Medium EPSS 0.43% |
< 4.29.0 | 4.29.0 |
| GHSA-855c-r2vq-c292 Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS |
High EPSS 0.30% |
< 4.29.0 | 4.29.0 |
| GHSA-97v6-998m-fp4g ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context |
Medium EPSS 0.22% |
< 4.29.0 | 4.29.0 |
| GHSA-xhq9-58fw-859p ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API |
Medium EPSS 0.51% |
< 4.29.0 | 4.29.0 |
| GHSA-mj7r-x3h3-7rmr ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint |
Low EPSS 0.36% |
< 4.29.0 | 4.29.0 |
| GHSA-v9xm-ffx2-7h35 ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware |
High EPSS 0.38% |
< 4.28.0 | 4.28.0 |
| GHSA-9j9m-8wjc-ff96 Apostrophe CMS Insufficient Session Expiration vulnerability |
Critical EPSS 1.14% |
>= 2.63.0, < 3.4.0 | 3.4.0 |
| GHSA-4r9c-jghc-cx5m Cross-site Scripting in apostrophe |
Medium EPSS 0.50% |
>= 2.63.0, < 3.4.0 | 3.4.0 |
| GHSA-pv6r-vchh-cxg9 Denial of Service in apostrophe |
Low | < 2.97.1 | 2.97.1 |
| GHSA-h97g-4mx7-5p2p Open Redirect in apostrophe |
Medium | < 2.92.0 | 2.92.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor