CVE-2026-42853: ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and

ApostropheCMS versions up to 3.6.0 contain a command injection vulnerability (CWE-78, a weakness where user input is directly used in system commands without cleaning) in the @apostrophecms/cli package's apos create command. An attacker can input malicious commands through the password prompt that will execute on the host system because the input is not properly sanitized (cleaned of dangerous characters) before being used in a shell command.