Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@apostrophecms/seo

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7npmPublished

    @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

    CVE-2026-53608 · GHSA-wf43-fpp3-cf65

    Affected
    • npm @apostrophecms/seo <= 1.4.2
    Fixed in
    1.5.0· Vendor fix available
    Issue
    <img width="1919" height="1046" alt="curl" src="https://github.com/user-attachments/assets/8aa19ff1-7f4b-44ee-83d5-d0dd1a0269f6" / <img width="1919" height="775" alt="xss" src="https://github.com/user-attachments/assets/a65012e8-9b2f-416f-94df-c00493f2ca1d" / Summary The @apostrophecms/seo package injects the Google Analytics Tracking ID (seoGoogleTrackingId) and Google Tag Manager ID (seoGoogleTagManager) directly into <script tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. Details The vulnerable code is in nodemodules/@apostrophecms/seo/lib/nodes.js. Google Analytics (lines 218–224): Google Tag Manager (lines 358–362): These nodes are rendered by renderNodes() in ApostropheCMS core (modules/@apostrophecms/template/index.js lines 1176–1177): The…

    Recommended action: Upgrade to 1.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →