CVE-2026-113666

{
  "etk_id": "ETK-2026-483",
  "cve_id": "CVE-2026-113666",
  "display_id": "CVE-2026-113666",
  "ghsa_id": "GHSA-j5rq-xfvr-p969",
  "euvd_id": "EUVD-2026-105214",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Prototype property deletion in @apostrophecms/db-connect",
  "summary": "Versions of @apostrophecms/db-connect before 1.1.0 and apostrophe before 4.33.0 can allow an authenticated user with draft-view access to alter shared JavaScript prototype state through projection handling. On SQLite, PostgreSQL, or multipostgres deployments, this can disrupt request processing across the Node.js process until it is restarted.",
  "mitigation": "Upgrade @apostrophecms/db-connect to 1.1.0 or later and apostrophe to 4.33.0 or later. Until upgrades are complete, reduce exposure by avoiding the affected SQL adapters or restricting draft-view access.",
  "vendor": "npm",
  "product": "npm:@apostrophecms/db-connect",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.1.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.1.0"
      ],
      "package_name": "@apostrophecms/db-connect",
      "purl": "pkg:npm/@apostrophecms/db-connect"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 4.33.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "4.33.0"
      ],
      "package_name": "apostrophe",
      "purl": "pkg:npm/apostrophe"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 5.022029666666667,
  "t0_at": "2026-10-20T17:25:44.574000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-03T18:33:36.435166+00:00",
      "days": -16.95287197724537,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T17:25:44.574000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-10-02T13:23:33+00:00",
      "days": -18.16818951388889,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T17:25:44.574000+00:00",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-j5rq-xfvr-p969"
    },
    "trigger_signal": {
      "at": "2026-10-02T13:23:33+00:00",
      "days": -18.16818951388889,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T17:25:44.574000+00:00",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-j5rq-xfvr-p969"
    }
  }
}