Skip to content

Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip

High
boutell published GHSA-hvx2-4ghc-j37m May 13, 2026

Package

npm apostrophe (npm)

Affected versions

<=4.29.0

Patched versions

None

Description

Original vulnerability is a busted link

Assign credit to Muhammad

Severity

High

CVE ID

CVE-2026-45014

Weaknesses

No CWEs

Credits