https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:04:20 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-327357 EUVD-2026-327357 https://cve.radiocsirt.org/vuln/euvd-2026-327357 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53609 <p>ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process. As of time of publication, no known patched versions are available.</p> <p>ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process. As of time of publication, no known patched versions are available.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53609 https://cve.radiocsirt.org/vuln/ghsa-6h5j-32cf-4253 <p><strong>Affected:</strong> npm: apostrophe</p> <p>&lt;img width=&#34;1919&#34; height=&#34;1046&#34; alt=&#34;proto&#34; src=&#34;https://github.com/user-attachments/assets/c5c69718-6448-448d-b64b-e3db41ab6ff6&#34; /&gt;</p> <p>## Summary</p> <p>`apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator.</p> <p>A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process.</p> <p>---</p> <p>## Details</p> <p>### Root Cause — `apos.util.set()` (`modules/@apostrophecms/util/index.js` ~line 800)</p> <p>The function splits a dot-notation path and traverses properties without rejecting `__proto__`, `constructor`, or `prototype`:</p> <p>```js set(o, path, v) { path = path.split(&#39;.&#39;); for (i = 0; i &lt; path.length - 1; i++) { o = o[path[i]]; // when path[i] === &#39;__proto__&#39;, o becomes Object.prototype } o[path[i]] = v; // mutates Object.prototype } ```</p> <p>### Source — `implementPatchOperators()` (`modules/@apostrophecms/schema/index.js` ~line 1737)</p> <p>User-controlled keys from the `$pullAll` operator are passed directly to `apos.util.set()`:</p> <p>```js _.each(patch.$pullAll, function(val, key) { cloneOriginalBase(key); // uses _.has (hasOwnProperty) self.apos.util.set(patch, key, ...); // key is fully attacker-controlled }); ```</p> <p>`cloneOriginalBase()` does not sanitize `__proto__` because `_.has()` performs an own-propert…</p> <p><strong>Affected:</strong> npm: apostrophe</p> <p>&lt;img width=&#34;1919&#34; height=&#34;1046&#34; alt=&#34;proto&#34; src=&#34;https://github.com/user-attachments/assets/c5c69718-6448-448d-b64b-e3db41ab6ff6&#34; /&gt;</p> <p>## Summary</p> <p>`apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator.</p> <p>A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process.</p> <p>---</p> <p>## Details</p> <p>### Root Cause — `apos.util.set()` (`modules/@apostrophecms/util/index.js` ~line 800)</p> <p>The function splits a dot-notation path and traverses properties without rejecting `__proto__`, `constructor`, or `prototype`:</p> <p>```js set(o, path, v) { path = path.split(&#39;.&#39;); for (i = 0; i &lt; path.length - 1; i++) { o = o[path[i]]; // when path[i] === &#39;__proto__&#39;, o becomes Object.prototype } o[path[i]] = v; // mutates Object.prototype } ```</p> <p>### Source — `implementPatchOperators()` (`modules/@apostrophecms/schema/index.js` ~line 1737)</p> <p>User-controlled keys from the `$pullAll` operator are passed directly to `apos.util.set()`:</p> <p>```js _.each(patch.$pullAll, function(val, key) { cloneOriginalBase(key); // uses _.has (hasOwnProperty) self.apos.util.set(patch, key, ...); // key is fully attacker-controlled }); ```</p> <p>`cloneOriginalBase()` does not sanitize `__proto__` because `_.has()` performs an own-propert…</p> https://cve.radiocsirt.org/vuln/ghsa-6h5j-32cf-4253