Stored XSS Vulnerability in ApostropheCMS SEO Package by Apostrophe

CVE-2026-53608

What is CVE-2026-53608?

A vulnerability exists in the ApostropheCMS open-source Node.js content management system that allows users with editor-level access to inject malicious JavaScript code. The @apostrophecms/seo package directly embeds the Google Analytics Tracking ID and Google Tag Manager ID into <script> tags without adequate sanitization, exposing the system to stored XSS attacks. This means any attacker can manipulate these fields to execute harmful scripts on any page, affecting all visitors. As of the latest update, there are no known patched versions available.

References