Skip to content
OpenAdvisories

Product · apostrophecms

db-connect

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2026-113666

    ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service

    ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a sha…

    apostrophecms apostrophe db-connect apostrophe npm