Is CVE-2026-112958 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-112958?

CVE-2026-112958 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-112958

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered. This issue is fixed in version 4.34.0.