Apostrophe has stored XSS via javascript: URL in Image Widget Link

Description

A stored cross-site scripting vulnerability was identified in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload.

Because editors have permission to publish pages, the malicious widget can be published to the live site.

Recommendation

No fix is available yet. Followings are affected versions:

• = 4.29.0

References

• GHSA-5f64-7vfc-rcx6
• CVE-2026-45011
• CWE-116
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
• Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
• Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget - CVE-2026-45012
• Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries - CVE-2026-32728

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

apostrophe