# CVE-2023-49276: Louis Lam Uptime Kuma attribute injection leading to XSS

Source: https://junglewise.ai/threats/cve-2023-49276-louis-lam-uptime-kuma-attribute-injection-leading-to-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-11-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-49276 · Severity: low · CVSS 3.1 · Published 2023-11-24

Uptime Kuma is a web-based service status monitoring and page application. An unsanitized input field in the custom status page's Google Analytics configuration allows authenticated administrators to inject arbitrary HTML attributes and JavaScript code, which executes in the browsers of other users viewing the status page. This can lead to session hijacking, credential theft, or malware delivery targeting status page visitors.

Technologies: [uptime-kuma (npm)](https://junglewise.ai/threats/technologies/uptime-kuma). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-49276 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-49276 being exploited in the wild.

**How severe is CVE-2023-49276?** Low severity, with a CVSS score of 3.1, published 24 November 2023.

**Which products and versions are affected?** uptime-kuma (npm) SEMVER:introduced=1.20.0,fixed=1.23.7.

**Is there a fix for CVE-2023-49276?** Yes. uptime-kuma (npm): upgrade to 1.23.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-49276 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2023-49276?** Check whether you run uptime-kuma (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- uptime-kuma (npm): upgrade to 1.23.7 or later

  ```sh
  npm install uptime-kuma@1.23.7
  ```


## Technical details

The vulnerability is an attribute injection / cross-site scripting (XSS) flaw (CWE-79) in the custom status page interface. The Google Analytics ID field is not sanitized before being rendered in the HTML template, allowing an authenticated user with status page editing privileges to inject malicious attributes such as onafterscriptexecute= and arbitrary JavaScript code. The attack requires network access and administrative privileges (low privilege requirement) plus user interaction to view the compromised status page, but can result in high integrity impact through script execution in users' browsers. The vulnerability affects versions 1.20.0 through 1.23.6 and was patched in version 1.23.7.

## Affected products

- Louis Lam Uptime Kuma >=1.20.0, <=1.23.6

## Identifiers

- CVE-2023-49276
- GHSA-v4v2-8h88-65qj

## Timeline

- 2023-11-24: disclosed
- 2023-11-24: patched: Version 1.23.7 released

## References

- [https://github.com/louislam/uptime-kuma/security/advisories/GHSA-v4v2-8h88-65qj](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-v4v2-8h88-65qj)

## Related threats

- [Uptime Kuma missing authorization check on ping badge endpoint](https://junglewise.ai/threats/cve-2026-32230-uptime-kuma-missing-authorization-check-on-ping-badge-endpoint)
- [Uptime Kuma Server-side Template Injection in notification templates](https://junglewise.ai/threats/uptime-kuma-server-side-template-injection-in-notification-templates-8547405a)
- [Uptime Kuma ReDoS in pushdeer and whapi notification providers](https://junglewise.ai/threats/cve-2025-26042-uptime-kuma-redos-in-pushdeer-and-whapi-notification-providers)
- [Uptime Kuma ReDoS in notification provider configuration](https://junglewise.ai/threats/uptime-kuma-redos-in-notification-provider-configuration-e7e79209)
- [Uptime Kuma authenticated remote code execution via plugin installation](https://junglewise.ai/threats/cve-2023-36821-uptime-kuma-authenticated-remote-code-execution-via-plugin)