CVE-2026-53608— @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
Possible ATT&CK Techniques 3AI
T1068 · Exploitation for Privilege Escalation T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| apostrophecms | @apostrophecms/seo | <= 1.4.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-53608
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
Source: NVD (National Vulnerability Database)
Vulnerability Description
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `<script>` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
ApostropheCMS 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
apostrophecms是Apostrophecms公司开源的一个内容管理系统。 ApostropheCMS 1.4.2及之前版本存在跨站脚本漏洞，该漏洞源于未对Google Analytics Tracking ID和Google Tag Manager ID进行清理或验证，可能导致任何具有编辑者级别访问权限的用户设置恶意值，从而造成存储型跨站脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| apostrophecms | @apostrophecms/seo | <= 1.4.2 | - |
II. Public POCs for CVE-2026-53608
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7160 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-53608
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-53608 (1)
Same Patch Batch · apostrophecms · 2026-06-12 · 10 CVEs total
| CVE-2026-44990 | 9.3 CRITICAL | Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` |
| CVE-2026-53609 | 9.1 CRITICAL | Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that l |
| CVE-2026-45013 | 8.1 HIGH | Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Inpu |
| CVE-2026-45012 | 7.6 HIGH | Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/valid |
| CVE-2026-45011 | 7.3 HIGH | Apostrophe has stored XSS via javascript: URL in Image Widget Link |
| CVE-2026-42853 | 6.5 MEDIUM | @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input |
| CVE-2026-53606 | 5.4 MEDIUM | sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through |
| CVE-2026-53607 | 3.7 LOW | @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header |
| CVE-2026-45014 | Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in |
IV. Related Vulnerabilities
Same vendor: apostrophecms
- CVE-2026-53609
Apostrophe has Server-Side Prototype Pollution in apos.util. - CVE-2026-53607
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated - CVE-2026-53606
sanitize-html has an incomplete URI scheme validation that a - CVE-2026-45014
Apostrophe Vulnerable to Stored Cross-Site Scripting via Uns - CVE-2026-45013
Apostrophe has a Weak Password Recovery Mechanism for Forgot
Same weakness: CWE-79
- CVE-2026-12048
pgAdmin 4: Stored XSS via untrusted error and plan-node text - CVE-2026-12047
pgAdmin 4: HTML injection in cloud verify_credentials / depl - CVE-2026-22674
Hashgraph Guardian Stored XSS via branding companyName field - CVE-2026-43915
Coturn: Stored Cross-Site Scripting (XSS) in web-admin inter - CVE-2026-11982
Stored XSS via missing XSS safety check in Admin2 Pages API
V. Comments for CVE-2026-53608
No comments yet