CVE-2026-53608 @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
Editors can inject malicious scripts via Google Analytics IDs, leading to stored XSS affecting all site visitors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53608?
CVE-2026-53608 is a high-severity cross-site scripting vulnerability in @apostrophecms/seo, published on 12 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `<script>` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available.
Weakness: CWE-79
Which versions are affected by CVE-2026-53608?
2 open source packages ship an affected version, including @apostrophecms/seo.
| Package | Affected | Fixed in |
|---|---|---|
@apostrophecms/seo npm | All versions | 1.5.0 |
@apostrophecms/seo npm | All versions | 1.5.0 |
How do I fix CVE-2026-53608?
Upgrade @apostrophecms/seo to 1.5.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-53608 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53608 exists.
Sources
Also known as GHSA-wf43-fpp3-cf65.