Apostrophe npm Package Vulnerability: Potential Authorization Bypass
An early warning has been issued regarding a potential vulnerability in the Apostrophe npm package that may allow an authenticated editor to bypass authorization on REST API endpoints.
What happened
The vulnerability reportedly affects the apos.util.set() function in Apostrophe, which appears to traverse dot-notation paths without sanitizing __proto__. This could enable an authenticated editor to write arbitrary values to Object.prototype, leading to a process-wide authorization bypass for all subsequent unauthenticated requests.
Affected versions include those introduced from 2.63.0 to 3.4.0, 4.29.0, and others as specified in the tracked IDs. It is under investigation whether other versions are also vulnerable.
Professional software engineers using Apostrophe are advised to upgrade to a patched version and review the PATCH body for any signs of unauthorized access. Consult the primary sources for the most accurate and up-to-date information.
How 0Day mitigates this
apostrophe is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.