DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-53608: CVE-2026-53608: Stored Cross-Site Scripting in @apostrophecms/seo via Unsanitized Tracking IDs

#security #cve #cybersecurity

CVE-2026-53608: Stored Cross-Site Scripting in @apostrophecms/seo via Unsanitized Tracking IDs

Vulnerability ID: CVE-2026-53608
CVSS Score: 8.7
Published: 2026-07-31

A stored Cross-Site Scripting (XSS) vulnerability exists in the @apostrophecms/seo package of the ApostropheCMS ecosystem up to and including version 1.4.2. Unsanitized user inputs for Google Analytics and Google Tag Manager IDs are injected directly into script elements within the document header, enabling authenticated editors to execute arbitrary JavaScript in the context of all site visitors.

TL;DR

Authenticated editors can execute stored Cross-Site Scripting (XSS) across all site visitors by injecting malicious payloads into Google Analytics/Tag Manager configuration fields in @apostrophecms/seo <= 1.4.2.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS Severity Score: 8.7
  • EPSS Score: 0.0021
  • Impact Category: Stored Cross-Site Scripting (XSS)
  • Exploit Maturity: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • ApostropheCMS installations with the @apostrophecms/seo extension active
  • @apostrophecms/seo: <= 1.4.2 (Fixed in: 1.4.3)

Code Analysis

Commit: 5a88e96

Fix stored XSS vulnerabilities in SEO tracking script rendering by separating dynamic values into JSON elements passed through escape functions.

Mitigation Strategies

  • Update the @apostrophecms/seo package dependency to a version strictly higher than 1.4.2.
  • Enforce database-level input constraints and sanitization regex checks on tracking properties.
  • Implement a robust Content Security Policy (CSP) to restrict inline script execution pathways.

Remediation Steps:

  1. Open your project package.json file.
  2. Update the '@apostrophecms/seo' package definition to reference the patched release version.
  3. Run your package manager install command to apply the dependency update.
  4. Scan the database for existing tracking configuration entries containing non-alphanumeric characters.
  5. Remove or sanitize invalid structures to prevent post-upgrade persistent anomalies.

References

Read the full report for CVE-2026-53608 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)