Apostrophecms @apostrophecms/cli vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Apostrophecms @apostrophecms/cli: 1 record(s), with affected versions and fixes.

CVE-2026-42853 Medium · 6.5 CWE-78 Jun 12, 2026

@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input

ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system. As of time of publication, no known patched versions are available.