https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T11:40:19.719729+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-71553 fkie_cve-2026-71553 2026-10-01T11:40:19.724504+00:00

ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.

 https://vulnerability.circl.lu/vuln/ghsa-vmg4-6gfg-83qx GHSA-vmg4-6gfg-83qx — ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS 2026-10-01T11:40:19.724641+00:00

Affected: npm: apostrophe

The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/<id>" with a valid editor session and body of {"toString.call":"x"}, overwriting the global toString function with value x.

Fabian