https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T22:44:56.389028+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-210504 EUVD-2026-210504 2026-10-15T22:44:56.391780+00:00 EUVD-2026-210504 https://cve.radiocsirt.org/vuln/fkie_cve-2023-32325 fkie_cve-2023-32325 2026-10-15T22:44:56.391809+00:00

PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cross-site scripting. Problem has been patched in 1.57.2. Users are advised to upgrade. Users unable to upgrade should ensure that their Content Security Policy is in place.

 https://cve.radiocsirt.org/vuln/ghsa-8775-5hwv-wr6v GHSA-8775-5hwv-wr6v — Potential for cross-site scripting in PostHog-js 2026-10-15T22:44:56.391838+00:00

Affected: npm: posthog-js

### Impact

Potential for cross-site scripting in `posthog-js`.

### Patches

The problem has been patched in `posthog-js` version 1.57.2.

### Workarounds

- This isn't an issue for sites that have a Content Security Policy in place. - Using the HTML tracking snippet on PostHog Cloud always guarantees the latest version of the library – in that case no action is required to upgrade to the patched version.

### References

We will publish details of the vulnerability in 30 days as per our [security policy](https://posthog.com/handbook/company/security#policies).

 https://cve.radiocsirt.org/vuln/gsd-2023-32325 gsd-2023-32325 2026-10-15T22:44:56.391872+00:00 gsd-2023-32325