CVE-2026-33889 : 상세 정보

CVE-2026-33889

5.4
/
보통
0.01%V4
2026-04-15
20h16 +00:00
Cross-site Scripting
A03-Injection
Network
2026-10-26
22h10 +00:00
CVE.org
NVD
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
알림 관리

CVE 설명

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module, where color values prefixed with -- bypass TinyColor validation intended for CSS custom properties, and the launder.string() call performs only type coercion without stripping HTML metacharacters. These unsanitized values are then concatenated directly into