CVE-2026-113659

## Summary The client-side helper `apos.http.parseQuery()` in ApostropheCMS builds a nested object from a URL query string without sanitizing the keys `__proto__`, `constructor`, or `prototype`. Parsing an attacker-controlled query string therefore writes arbitrary properties onto `Object.prototype` (client-side prototype pollution). ApostropheCMS's admin UI calls this parser with `window.location.search` on **every authenticated page load** (the admin context bar's `data()` initializer). Because the admin UI is built on Vue, a polluted, enumerable property on `Object.prototype` is then picked up by Vue's standard element-mount routine and written to the DOM as an element property, turning the prototype pollution into DOM-based XSS in the victim's authenticated session. The escalation gadget is a well-known, general Vue behavior; the novel, reportable defect is the unsanitized `parseQuery` source together with the authenticated trigger, both of which are ApostropheCMS code. Any user who can get **any logged-in user (from the lowest-privileged `guest` role up to the highest-privileged `admin` role)** to open a crafted URL can execute arbitrary JavaScript in that user's session. This is **distinct from CVE-2026-53609** (server-side prototype pollution via `apos.util.set()` / `$pullAll`, fixed in 4.31.0): different side (client vs server), different code path, and the vulnerable code here is present in the current release. ## Package - **Ecosystem:** npm - **Package:** `apostrophe` - **Affected versions:** all **4.x** releases, **4.0.0 through 4.32.2** (current `latest`). Verified by inspecting the published npm tarballs: `[email protected]` already contains the vulnerable descent (`parentKey = 'root'`) with no `__proto__`/`constructor`/`prototype` filtering, and `[email protected]` is unchanged in this respect. The vulnerable `parseQuery()` logic was introduced in commit `0255086bf` (2020-11-12), well before the 4.0 version, so **ApostropheCMS 3.x is al