CMS

apostrophecms/apostrophe

A full-featured, open-source content management framework built with Node.js that empowers organizations by combining in-context editing and headless architecture in a full-stack JS environment.

#cms#cms-framework#node#javascript#apostrophe#nodejs#node-js#jamstack#website-builder

スコア

/ 100

Star

4,557

Fork

629

Open Issue

121

サイズ

49MB

言語

JavaScript ★

最終push

0 日前

Docker

—

採点内訳

過去CVE 14件 (やや多い)

✓

直近 push: 1 日前

✓

得意言語 (JavaScript)

✓

オープンissue 121件

✓

中規模 (49MB)

✓

Docker 未対応

—

1k–10k: 初心者ベスト (★4,557)

✓

※ 各項目の重みは「採点ルール」を参照。合計は 0 で底打ち。

過去の SecurityAdvisory (14 件)

HIGHGHSA-pr28-mf3q-qpg6 CVE-2026-450122026/5/13
Authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
MEDIUMGHSA-hcwq-x9fw-8cfq CVE-2026-428532026/5/13
Command Injection in apos create via Unsanitized Password Input (CWE-78)
HIGHGHSA-gf43-24g3-5hw2 CVE-2026-450132026/5/13
Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation in apostrophe
HIGHGHSA-5f64-7vfc-rcx6 CVE-2026-450112026/5/13
Stored XSS via javascript: URL in Image Widget Link
CRITICALGHSA-rpr9-rxv7-x643 CVE-2026-449902026/5/13
Default XSS via `xmp` raw-text passthrough in `sanitize-html`
HIGHGHSA-hvx2-4ghc-j37m CVE-2026-450142026/5/13
Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip
LOWGHSA-mj7r-x3h3-7rmr CVE-2026-338772026/4/15
User Enumeration via Timing Side Channel in Password Reset Endpoint
MEDIUMGHSA-xhq9-58fw-859p CVE-2026-338882026/4/15
publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API
MEDIUMGHSA-97v6-998m-fp4g CVE-2026-338892026/4/15
Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context
MEDIUMGHSA-9mrh-v2v3-xpfm CVE-2026-401862026/4/15
sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
MEDIUMGHSA-c276-fj82-f2pq CVE-2026-398572026/4/15
Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions
HIGHGHSA-855c-r2vq-c292 CVE-2026-355692026/4/15
Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
CRITICALGHSA-v9xm-ffx2-7h35 CVE-2026-327302026/3/18
MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
CRITICALGHSA-mwxc-m426-3f78 CVE-2026-327312026/3/18
Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction