Skip to content
OpenAdvisories

Package · npm

apostrophe

35 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-53609

    Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

    ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.pro…

    apostrophecms apostrophe apostrophe npm
  • Critical 9.8
    CVE-2021-25979

    Apostrophe - Insufficient Session Expiration

    Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigati…

    Apostrophe Apostrophe apostrophe npm