CVE-2026-113671: 
JavaScript vulnerability analysis and mitigation

CVE-2026-113671 is a Server-Side Request Forgery (SSRF) vulnerability in the @apostrophecms/ai-helper npm package for ApostropheCMS, an open-source Node.js CMS. The flaw allows an authenticated editor with image-generation capability to coerce the server into issuing outbound HTTP GET requests to an attacker-selected host and port by manipulating the HTTP Host header. Affected versions are @apostrophecms/ai-helper >= 1.0.0-beta.10 and < 1.0.0-beta.13, and apostrophe core >= 4.25.0 and < 4.33.0. The advisory was published on October 2, 2026, and added to the GitHub Advisory Database on October 20, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Feedly).

The root cause (CWE-918) lies in packages/ai-helper/modules/@apostrophecms/ai-helper-image/index.js, where the aiHelperImageUrl function constructs a server-side fetch URL by resolving a relative storage path (/uploads/ai-helper-images/<_id>.png) against req.baseUrl. When apos.baseUrl is not configured (the default), req.baseUrl is derived from the incoming HTTP Host header via the i18n middleware (setPrefixUrls, line 799–820). An attacker first POSTs to /api/v1/@apostrophecms/image/ai-helper to generate a base64 AI image record (which is persisted without a stored url field), then sends a PATCH accept request with a crafted Host header (e.g., Host: 169.254.169.254); the server resolves the fetch target as http://169.254.169.254/uploads/ai-helper-images/<_id>.png and issues the outbound GET. A compounding flaw is that the PATCH accept route (apiRoutes.patch['ai-helper/:_id']) performs no authorization or ownership check — unlike the POST generate route which calls checkPermissions — and no allowlist constrains the resolved origin before fetch() is called (GitHub Advisory).

Successful exploitation enables a low-privileged authenticated editor to probe internal hosts and ports that are not reachable from the attacker's external network position, constituting a classic SSRF primitive. The request path is fixed to /uploads/ai-helper-images/<_id>.png, so only the origin (host, port, and HTTP scheme) is attacker-controlled — arbitrary-path retrieval (e.g., cloud metadata endpoint traversal via /latest/meta-data/) is not directly achievable through this primitive alone. Limited semi-blind exfiltration is possible where an image-parseable response at the fixed path becomes a viewable attachment; no integrity or availability impact was demonstrated. The vulnerability is scoped to deployments using local relative uploadfs storage with no configured global base URL (GitHub Advisory, Feedly).

A proof-of-concept exploit consisting of a concrete step-by-step HTTP request sequence is publicly documented in the GitHub Security Advisory (GHSA-527g-ff96-x6wj). Exploitation requires an authenticated low-privileged editor account, a configured base64-returning AI image provider, no global apos.baseUrl set, and local uploadfs storage — conditions that match the default deployment. There is no evidence of in-the-wild exploitation at this time, and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog. The NVD SSVC assessment classifies exploitation as "poc" and technical impact as "partial" (GitHub Advisory, Feedly).

1. Authenticate: Log in to the ApostropheCMS instance as a low-privileged editor account that has edit capability on at least one content type and access to the AI image generation feature.
2. Generate a base64 AI image record: Send a POST request to create an AI image without a stored URL:

   POST /api/v1/@apostrophecms/image/ai-helper
   Content-Type: application/json
   {"prompt": "x"}

   The response returns a record _id. The persisted database record has no url field because insertOne(image) runs before image.url is assigned in memory.
3. Send PATCH accept request with malicious Host header: Use the returned _id and supply an attacker-controlled Host header:

   PATCH /api/v1/@apostrophecms/image/ai-helper/<_id> HTTP/1.1
   Host: 169.254.169.254
   Content-Type: application/json
   {"accepted": true}

4. Server resolves attacker-controlled fetch target: The i18n middleware sets req.baseUrl to http://169.254.169.254 (from the Host header, since apos.baseUrl is unset). aiHelperImageUrl computes new URL('/uploads/ai-helper-images/<_id>.png', 'http://169.254.169.254'), yielding http://169.254.169.254/uploads/ai-helper-images/<_id>.png.
5. Server issues outbound GET: aiHelperFetchImage calls fetch() on the resolved URL, causing the server to make an outbound HTTP GET to the attacker-chosen host and port at the fixed path, enabling internal network probing and limited semi-blind response retrieval (GitHub Advisory).

• Network: Unexpected outbound HTTP GET requests from the ApostropheCMS server to internal IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or unusual external hosts, targeting the path /uploads/ai-helper-images/<cuid2>.png.
• Logs: ApostropheCMS access logs showing POST requests to /api/v1/@apostrophecms/image/ai-helper followed by PATCH requests to /api/v1/@apostrophecms/image/ai-helper/<_id> with anomalous or internal-IP Host headers; Node.js application logs recording fetch errors or unexpected HTTP responses from internal addresses.
• Application Behavior: AI image records in the database that have no url field and were accepted (PATCH) by a user other than the one who generated them, or accepted with a Host header differing from the site's configured domain.

Primary fix: Upgrade @apostrophecms/ai-helper to version 1.0.0-beta.13 or later. The fix reads AI helper images directly from uploadfs (eliminating the HTTP fetch), enforces ownership and permissions on the accept and variation routes, and requires the same edit capability check on all AI image routes as the generate route (Release Notes, Patch Commit).

Interim workarounds (if immediate upgrade is not possible):

• Configure a trusted global base URL (apos.baseUrl) so req.baseUrl is fixed and cannot be influenced by the Host header.
• Implement server-side egress controls (firewall rules) to prevent the Node.js process from making outbound requests to internal/metadata IP ranges.
• Restrict the AI image-generation capability to the minimum set of trusted editors.

The vulnerability was reported by Daniel Coles (GitHub: @manus-pi / @manus-use) and acknowledged by the ApostropheCMS maintainer (boutell) in the official security advisory. The fix was merged as part of a broader batch of security advisories (commit f84fd41), addressing over a dozen separate vulnerabilities in the ApostropheCMS ecosystem simultaneously. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (GitHub Advisory, Patch Commit).