{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "@apostrophecms ai-helper: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/apostrophecms--ai-helper/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/apostrophecms--ai-helper/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113671/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113671/",
   "title": "CVE-2026-113671 · apostrophecms apostrophe · disclosed",
   "content_text": "ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local relative storage with no trusted global base URL. The server resolves the fixed uploads path against a request-controlled Host-derived origin, enabling bounded server-side requests to an attacker-selected host, port, and HTTP origin, but not arbitrary-path retrieval or the stored-provider and absolute-storage configurations. This issue is fixed in AI helper 1.0.0-beta.13.",
   "date_published": "2026-10-20T17:43:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113671/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113671/",
   "title": "CVE-2026-113671 · apostrophecms apostrophe · fixed upstream (npm)",
   "content_text": "Fixed versions: @apostrophecms/ai-helper 1.0.0-beta.13.",
   "date_published": "2026-10-20T17:43:53Z"
  }
 ]
}