https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T18:28:58.720360+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-327357 EUVD-2026-327357 2026-10-05T18:28:58.771652+00:00 EUVD-2026-327357 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53609 fkie_cve-2026-53609 2026-10-05T18:28:58.771694+00:00

ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process. As of time of publication, no known patched versions are available.

 https://cve.radiocsirt.org/vuln/ghsa-6h5j-32cf-4253 GHSA-6h5j-32cf-4253 — Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authoriz… 2026-10-05T18:28:58.771731+00:00

Affected: npm: apostrophe

<img width="1919" height="1046" alt="proto" src="https://github.com/user-attachments/assets/c5c69718-6448-448d-b64b-e3db41ab6ff6" />

## Summary

`apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator.

A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process.

---

## Details

### Root Cause — `apos.util.set()` (`modules/@apostrophecms/util/index.js` ~line 800)

The function splits a dot-notation path and traverses properties without rejecting `__proto__`, `constructor`, or `prototype`:

```js set(o, path, v) { path = path.split('.'); for (i = 0; i < path.length - 1; i++) { o = o[path[i]]; // when path[i] === '__proto__', o becomes Object.prototype } o[path[i]] = v; // mutates Object.prototype } ```

### Source — `implementPatchOperators()` (`modules/@apostrophecms/schema/index.js` ~line 1737)

User-controlled keys from the `$pullAll` operator are passed directly to `apos.util.set()`:

```js _.each(patch.$pullAll, function(val, key) { cloneOriginalBase(key); // uses _.has (hasOwnProperty) self.apos.util.set(patch, key, ...); // key is fully attacker-controlled }); ```

`cloneOriginalBase()` does not sanitize `__proto__` because `_.has()` performs an own-propert…