Apostrophe has stored XSS via javascript: URL in Image Widget Link

Description

A stored cross-site scripting vulnerability was identified in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload.

Because editors have permission to publish pages, the malicious widget can be published to the live site.

Recommendation

No fix is available yet. Followings are affected versions:

• = 4.29.0

References

• GHSA-5f64-7vfc-rcx6
• CVE-2026-45011
• CWE-116
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
• ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context - CVE-2026-33889
• SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
• HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft - CVE-2026-46496

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

How do hackers hack websites?

Tags:

npm

apostrophe