EUVD-2026-36589
GHSA-wf43-fpp3-cf65
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Editor role required (PR:L); stored XSS executes during normal browsing so UI:N rather than UI:R; scope changes from CMS to visitor browser (S:C) with high C/I impact, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the @apostrophecms/seo package injects the Google Analytics Tracking ID (seoGoogleTrackingId) and Google Tag Manager ID (seoGoogleTagManager) directly into <script> tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available.
AnalysisAI
Stored cross-site scripting in the @apostrophecms/seo plugin (versions ≤1.4.2) allows any user holding the default editor role to inject arbitrary JavaScript that executes in every visitor's browser. The seoGoogleTrackingId and seoGoogleTagManager fields are interpolated directly into inline <script> tag bodies via template literals with no sanitization, turning legitimate analytics configuration into a persistent payload delivery channel. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
Technical ContextAI
The affected component is the @apostrophecms/seo plugin for ApostropheCMS, a Node.js-based open-source content management system (CPE: cpe:2.3:a:apostrophecms:@apostrophecms/seo). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) realized through unsanitized JavaScript template literal interpolation: user-supplied values intended as opaque identifiers (e.g., 'UA-XXXXX' or 'GTM-XXXXX') are written directly inside <script>…</script> blocks rendered on every page. Because the injection point is already inside an executing JavaScript context, attackers do not even need to break out of an HTML attribute - any characters supplied become live code at parse time.
RemediationAI
No vendor-released patch identified at time of analysis; the advisory at https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wf43-fpp3-cf65 explicitly states no patched version is yet available. As compensating controls until a fix ships: restrict the editor role to highly trusted users only and audit current holders, since editor is the default content-manager role and is the abuse vector; remove or disable the @apostrophecms/seo module if Google Analytics/Tag Manager are not required, accepting loss of integrated SEO management; if analytics are required, hardcode seoGoogleTrackingId and seoGoogleTagManager values in server-side configuration outside the CMS UI rather than via editor-managed fields; and deploy a strict Content Security Policy that forbids inline script execution (script-src without 'unsafe-inline'), noting this will break any other inline scripts the theme relies on and requires nonce/hash refactoring. Monitor the advisory URL for the patched release.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today