THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-vmg4-6gfg-83qx (high) — ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

[GHSA] GHSA-vmg4-6gfg-83qx (high) — ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

medgithub_advisoriesPublished 2026-09-02

GHSA-vmg4-6gfg-83qx Severity: high CVE: CVE-2026-71553

ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/<id>" with a valid editor session and body of {"toString.call":"x"}, overwriting the global toString function with value x.

Fabian

Indicators of compromise

CVE-2026-71553cve

Original source: https://github.com/advisories/GHSA-vmg4-6gfg-83qx