GHSA-VMG4-6GFG-83QX高危已审查

ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

OSV 1.4.0 · github-reviewed · 修改于 2026-09-02 23:12

发布时间

2026-09-02 23:12

GitHub 审查时间

2026-09-02 23:12

NVD 发布时间

2026-08-18 04:16

源文件

advisories/github-reviewed/2026/09/GHSA-vmg4-6gfg-83qx/GHSA-vmg4-6gfg-83qx.json

公告说明

The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/<id>" with a valid editor session and body of {"toString.call":"x"}, overwriting the global toString function with value x.

Fabian

受影响的软件包

npm

apostrophe

ECOSYSTEM

引入0最后受影响4.32.0

标识信息

别名 / CVE

CVE-2026-71553

CWE

CWE-1321

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-vmg4-6gfg-83qx",
  "aliases": [
    "CVE-2026-71553"
  ],
  "details": "The vulnerability is a single-request persistent DoS by submitting e.g.\n\"PATCH /api/v1/article/<id>\" with a valid editor session and body of\n{\"toString.call\":\"x\"}, overwriting the global toString function with\nvalue x.\n\nFabian",
  "summary": "ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "4.32.0"
            }
          ]
        }
      ],
      "package": {
        "name": "apostrophe",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2026-09-02T15:12:42Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-09-02T15:12:41Z",
  "references": [
    {
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmg4-6gfg-83qx",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71553",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/apostrophecms/apostrophe/commit/5a3746aaed49761e171c2cbfe793267c959829fd",
      "type": "WEB"
    },
    {
      "url": "https://github.com/apostrophecms/apostrophe",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2026-08-17T20:16:46Z",
    "github_reviewed_at": "2026-09-02T15:12:41Z"
  }
}