Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:NSummary
CVE-2026-35569 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Apostrophecms Apostrophecms. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-35569 is a stored cross-site scripting (XSS) vulnerability affecting ApostropheCMS, an open-source Node.js content management system. Versions 4.28.0 and prior fail to properly encode user-controlled input in SEO-related fields, such as SEO Title and Meta Description. This input is rendered into HTML contexts including <title> tags, <meta> attributes, and JSON-LD structured data without adequate output encoding, allowing attackers to inject payloads like "></title><script>alert(1)</script>" to escape the intended context.
An authenticated attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) by injecting a malicious payload into the affected SEO fields. When another authenticated user views the page (UI:R), the payload executes arbitrary JavaScript in their browser, achieving high confidentiality and integrity impacts (C:H/I:H) with a changed scope (S:C). This enables the attacker to perform authenticated API requests on behalf of the victim, accessing sensitive data such as usernames, email addresses, and user roles via internal APIs, and exfiltrating it to an attacker-controlled server. The vulnerability is rated 8.7 on the CVSS 3.1 scale and maps to CWE-79 (XSS) and CWE-116 (Improper Encoding).
The issue has been addressed in ApostropheCMS version 4.29.0, as detailed in the project's GitHub security advisory (GHSA-855c-r2vq-c292) and the fixing commit (0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3), which implement proper output encoding for the affected fields. Security practitioners should upgrade to 4.29.0 or later and review any stored SEO content for malicious payloads. Additional details are available in the referenced CVE research repository.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23106
Vulnerability Data
ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts including <title>…
more
tags, <meta> attributes, and JSON-LD structured data. An attacker can inject a payload such as "></title><script>alert(1)</script> to break out of the intended HTML context and execute arbitrary JavaScript in the browser of any authenticated user who views the affected page. This can be leveraged to perform authenticated API requests, access sensitive data such as usernames, email addresses, and roles via internal APIs, and exfiltrate it to an attacker-controlled server. This issue has been fixed in version 4.29.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.2V1.2.1V1.2.3V1.3.2
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect input neutralization through targeted web-application tests.
Input validation directly enforces neutralization of untrusted data before it reaches web output generation.
Output filtering can catch or sanitize unneutralized script content before it is served to users.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly target introduction of XSS via coding standards/testing (mostly), yet the single broad outcome leaves many specific neutralization vectors unaddressed (partial).
Patching and EOL replacement can remediate known XSS instances in libraries or frameworks (partial) but do nothing to enforce input neutralization in application code (none).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards explicitly require correct output encoding and escaping to preserve message structure.
Secure-coding testing and automated code-analysis tools are applied to detect improper neutralization of script-related content during web-page generation.
Knowledge exchange on emerging attack techniques and patches reduces the likelihood that cross-site scripting flaws remain unaddressed in deployed applications.
Operational indicators of compromise for web-application attacks can be incorporated into WAF or input-filtering rules, lowering the likelihood that unsanitized data reaches the browser.
Requiring language-specific secure-coding standards and automated scanning during the SDLC catches missing output encoding or improper neutralization of untrusted data before the software reaches production.
Application security requirements include explicit rules for safe output handling and encoding.