@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

8.7 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

EPSS

• CVE-2026-53608: 0.26% estimated exploitation activity in the next 30 days; percentile 17.32 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

<img width="1919" height="1046" alt="curl" src="https://github.com/user-attachments/assets/8aa19ff1-7f4b-44ee-83d5-d0dd1a0269f6" / <img width="1919" height="775" alt="xss" src="https://github.com/user-attachments/assets/a65012e8-9b2f-416f-94df-c00493f2ca1d" / Summary The @apostrophecms/seo package injects the Google Analytics Tracking ID (seoGoogleTrackingId) and Google Tag Manager ID (seoGoogleTagManager) directly into <script tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. Details The vulnerable code is in nodemodules/@apostrophecms/seo/lib/nodes.js. Google Analytics (lines 218–224): Google Tag Manager (lines 358–362): These nodes are rendered by renderNodes() in ApostropheCMS core (modules/@apostrophecms/template/index.js lines 1176–1177): The…

Published by the source

31 Jul 2026, 21:53 UTC

Last modified by the source

31 Jul 2026, 21:53 UTC

Source last checked

26 Oct 2026, 13:00 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-wf43-fpp3-cf65

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-53608

Advisory: @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
IDs: CVE-2026-53608, GHSA-wf43-fpp3-cf65
Record: https://patchnext.com/advisories/cve-2026-53608 (revision 1, source checked 26 Oct 2026, 13:00 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.7)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: @apostrophecms/seo 1.5.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm @apostrophecms/seo: affected <= 1.4.2; fixed in 1.5.0

## Suggested inspection (read-only)
- `npm ls @apostrophecms/seo --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on @apostrophecms/seo.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-wf43-fpp3-cf65 (GitHub-reviewed advisory GHSA-wf43-fpp3-cf65 lists affected ranges: npm @apostrophecms/seo >=0 <=1.4.2)

Commands are suggestions: review each one before running it.