Vendor

    Apostrophe

    66 known vulnerabilities in products by Apostrophe, 0 of them actively exploited (CISA KEV).

    Key figures

    66

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Apostrophe
    CriticalCVE-2026-44990

    Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

    		9.3
    HighCVE-2026-113658

    Apostrophe: Incomplete Cleanup

    		7.5
    HighCVE-2026-113711

    Apostrophe: Allocation of Resources Without Limits or Throttling

    		7.5
    CriticalCVE-2021-25979

    Apostrophe - Insufficient Session Expiration

    		9.8
    CriticalCVE-2026-32731

    ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction

    		10.0
    MediumCVE-2026-112955

    ApostropheCMS: Import archives can exhaust server storage and deny service

    		6.5
    MediumCVE-2021-26539

    ApostropheCMS sanitize-html: security vulnerability

    		5.3
    HighCVE-2026-113666

    Apostrophe: Prototype Pollution

    		7.1
    MediumCVE-2026-112953

    ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

    		—
    MediumCVE-2021-26540

    ApostropheCMS sanitize-html: security vulnerability

    		5.3
    MediumCVE-2026-113653

    Apostrophe: Incorrect Authorization

    		—
    HighCVE-2022-25887

    Regular Expression Denial of Service (ReDoS)

    		5.3
    MediumCVE-2026-113664

    ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

    		—
    CriticalCVE-2026-53609

    Apostrophe: Prototype Pollution

    		9.1
    MediumCVE-2026-113650

    Apostrophe: Uncontrolled Recursion

    		5.3
    HighCVE-2026-71553

    ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

    		—
    MediumCVE-2026-113656

    ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

    		5.3
    MediumCVE-2026-112956

    ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

    		6.5
    MediumCVE-2026-112954

    Apostrophe: Exposure of Sensitive Information to an Unauthorized Actor

    		5.3
    MediumCVE-2026-63667

    ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

    		6.5
    MediumCVE-2026-113654

    Apostrophe: Cross-site Scripting

    		—
    MediumCVE-2026-42853

    @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input

    		6.5
    MediumCVE-2026-113669

    ApostropheCMS: Cross-domain session token in URL confers session takeover

    		—
    MediumCVE-2026-113659

    Apostrophe: Prototype Pollution

    		6.1
    MediumCVE-2026-113649

    ApostropheCMS: Import API bypasses publication roles for protected content

    		6.5

    All vulnerabilities in search

    News

    Products

    Products by Apostrophe
    Apostrophe510
    ApostropheCMS sanitize-html140
    Apostrophe100
    Import-export80