{"id":"EUVD-2026-36589","enisaUuid":"81992eec-52be-38d2-a0c6-47fc54ad2656","description":"ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `\u003cscript\u003e` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available.","datePublished":"Jun 12, 2026, 8:57:48 PM","dateUpdated":"Jun 15, 2026, 5:49:39 PM","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wf43-fpp3-cf65\n","aliases":"CVE-2026-53608\nGHSA-wf43-fpp3-cf65\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"a511d2e9-f1a5-3d60-987c-ed453770d756","product":{"name":"@apostrophecms/seo","vendor":{"name":"apostrophecms"}},"product_version":"≤ 1.4.2"}],"enisaIdVendor":[{"id":"a763393c-317c-312b-9663-d1b82c72e733","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"aa54c933-6e0d-3235-a255-7af376be89bd","vulnerability":{"id":"GHSA-wf43-fpp3-cf65","description":"@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag","datePublished":"Jul 31, 2026, 9:53:56 PM","dateUpdated":"Jul 31, 2026, 9:53:56 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wf43-fpp3-cf65\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53608\nhttps://github.com/apostrophecms/apostrophe/pull/5464\nhttps://github.com/apostrophecms/apostrophe/commit/5a88e9630cbbdde33154ef8abe7557ddf7be418b\nhttps://github.com/apostrophecms/apostrophe\n","enisa_id":"EUVD-2026-36589\n","aliases":"GHSA-wf43-fpp3-cf65\nCVE-2026-53608\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f921ca38-9022-3533-83e3-ce949c5c8fae","vulnerability":{"id":"CVE-2026-53608","description":"ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `\u003cscript\u003e` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available.","datePublished":"Jun 12, 2026, 8:57:48 PM","dateUpdated":"Jun 15, 2026, 5:49:39 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wf43-fpp3-cf65\n","enisa_id":"EUVD-2026-36589\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Nov 7, 2026, 7:20:34 AM","vulnerabilityProduct":[{"id":"1a316c69-d782-3748-92ce-521a85b6f797","product":{"name":"@apostrophecms/seo","vendor":{"name":"apostrophecms"}},"product_version":"≤ 1.4.2"}],"vulnerabilityVendor":[{"id":"c07e47a3-f307-3d7d-abd5-73024eb3725e","vendor":{"name":"apostrophecms"}}]}}],"enisaIdAdvisory":[]}