npm

apostrophe

35 Total advisories

35 Vulnerabilities

0 Malware

Dependency scanning

Check whether apostrophe is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

apostrophe

Vulnerabilities

ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

ApostropheCMS: Import API bypasses publication roles for protected content

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)

ApostropheCMS: Page REST API authorization bypass

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service

ApostropheCMS: Cross-domain session token in URL confers session takeover

ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation

Apostrophe has stored XSS via javascript: URL in Image Widget Link

Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS

ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API

ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint

ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context

ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

Apostrophe CMS Insufficient Session Expiration vulnerability

Cross-site Scripting in apostrophe

Open Redirect in apostrophe

Denial of Service in apostrophe

Browse more npm advisories

Start Securing