CVE-2026-42853

ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system. As of time of publication, no known patched versions are available.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.6 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hcwq-x9fw-8cfq
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hcwq-x9fw-8cfq

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) ApostropheCMS es un sistema de gestión de contenido de código abierto basado en Node.js. Las versiones del paquete @apostrophecms/cli hasta la 3.6.0 inclusive contienen una vulnerabilidad de inyección de comandos en el comando ’apos create’. La entrada proporcionada por el usuario desde la solicitud de contraseña se incrusta directamente en un comando de shell sin una sanitización o escape adecuados. Esto permite la ejecución de comandos arbitrarios en el sistema anfitrión. En el momento de la publicación, no hay versiones parcheadas conocidas disponibles.

Information

Published : 2026-06-12 21:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-42853

Mitre link : CVE-2026-42853

CVE.ORG link : CVE-2026-42853

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-42853", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42853", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-13T03:34:07.787771Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "apostrophecms", "product": "@apostrophecms/cli", "versions": [{"status": "affected", "version": "<= 3.6.0"}]}]}], "published": "2026-06-12T21:16:21.300", "references": [{"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hcwq-x9fw-8cfq", "source": "security-advisories@github.com"}, {"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hcwq-x9fw-8cfq", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system. As of time of publication, no known patched versions are available."}, {"lang": "es", "value": "ApostropheCMS es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto basado en Node.js. Las versiones del paquete @apostrophecms/cli hasta la 3.6.0 inclusive contienen una vulnerabilidad de inyecci\u00f3n de comandos en el comando \u2019apos create\u2019. La entrada proporcionada por el usuario desde la solicitud de contrase\u00f1a se incrusta directamente en un comando de shell sin una sanitizaci\u00f3n o escape adecuados. Esto permite la ejecuci\u00f3n de comandos arbitrarios en el sistema anfitri\u00f3n. En el momento de la publicaci\u00f3n, no hay versiones parcheadas conocidas disponibles."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}