https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:23:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-327331 EUVD-2026-327331 https://cve.radiocsirt.org/vuln/euvd-2026-327331 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53608 <p>ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `&lt;script&gt;` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available.</p> <p>ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `&lt;script&gt;` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53608 https://cve.radiocsirt.org/vuln/ghsa-wf43-fpp3-cf65 <p><strong>Affected:</strong> npm: @apostrophecms/seo</p> <p>&lt;img width=&#34;1919&#34; height=&#34;1046&#34; alt=&#34;curl&#34; src=&#34;https://github.com/user-attachments/assets/8aa19ff1-7f4b-44ee-83d5-d0dd1a0269f6&#34; /&gt; &lt;img width=&#34;1919&#34; height=&#34;775&#34; alt=&#34;xss&#34; src=&#34;https://github.com/user-attachments/assets/a65012e8-9b2f-416f-94df-c00493f2ca1d&#34; /&gt;</p> <p>### Summary</p> <p>The `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `&lt;script&gt;` tag bodies using JavaScript template literals without any sanitization or validation.</p> <p>Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site.</p> <p>### Details</p> <p>The vulnerable code is in `node_modules/@apostrophecms/seo/lib/nodes.js`.</p> <p>**Google Analytics (lines 218–224):**</p> <p>```javascript // seoGoogleTrackingId is inserted RAW into a &lt;script&gt; body — no escaping, no validation body: [ { raw: ` window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag(&#39;js&#39;, new Date()); gtag(&#39;config&#39;, &#39;${global.seoGoogleTrackingId}&#39;); ` } ] ```</p> <p>**Google Tag Manager (lines 358–362):**</p> <p>```javascript body: [ { raw: `(function(w,d,s,l,i){...})(window,document,&#39;script&#39;,&#39;dataLayer&#39;,&#39;${global.seoGoogleTagManager}&#39;);` } ] ```</p> <p>These nodes are rendered by `renderNodes()` in ApostropheCMS core (`modules/@apostrophecms/template/index.js` lines 1176–1177):</p> <p>```javascript if (node.r…</p> <p><strong>Affected:</strong> npm: @apostrophecms/seo</p> <p>&lt;img width=&#34;1919&#34; height=&#34;1046&#34; alt=&#34;curl&#34; src=&#34;https://github.com/user-attachments/assets/8aa19ff1-7f4b-44ee-83d5-d0dd1a0269f6&#34; /&gt; &lt;img width=&#34;1919&#34; height=&#34;775&#34; alt=&#34;xss&#34; src=&#34;https://github.com/user-attachments/assets/a65012e8-9b2f-416f-94df-c00493f2ca1d&#34; /&gt;</p> <p>### Summary</p> <p>The `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `&lt;script&gt;` tag bodies using JavaScript template literals without any sanitization or validation.</p> <p>Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site.</p> <p>### Details</p> <p>The vulnerable code is in `node_modules/@apostrophecms/seo/lib/nodes.js`.</p> <p>**Google Analytics (lines 218–224):**</p> <p>```javascript // seoGoogleTrackingId is inserted RAW into a &lt;script&gt; body — no escaping, no validation body: [ { raw: ` window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag(&#39;js&#39;, new Date()); gtag(&#39;config&#39;, &#39;${global.seoGoogleTrackingId}&#39;); ` } ] ```</p> <p>**Google Tag Manager (lines 358–362):**</p> <p>```javascript body: [ { raw: `(function(w,d,s,l,i){...})(window,document,&#39;script&#39;,&#39;dataLayer&#39;,&#39;${global.seoGoogleTagManager}&#39;);` } ] ```</p> <p>These nodes are rendered by `renderNodes()` in ApostropheCMS core (`modules/@apostrophecms/template/index.js` lines 1176–1177):</p> <p>```javascript if (node.r…</p> https://cve.radiocsirt.org/vuln/ghsa-wf43-fpp3-cf65