Is CVE-2026-53608 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53608 being exploited in the wild.

How severe is CVE-2026-53608?

High severity, with a CVSS score of 8.7, published 12 June 2026.

Which products and versions are affected?

ApostropheCMS Seo <= 1.4.2; @apostrophecms/seo (npm) <= 1.4.2, SEMVER:introduced=0,fixed=1.5.0.

Is there a fix for CVE-2026-53608?

Yes. @apostrophecms/seo (npm): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53608 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53608?

Check whether you run ApostropheCMS Seo or @apostrophecms/seo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53608: ApostropheCMS @apostrophecms/seo stored XSS in Google Tracking IDs

Q: Which products and versions are affected?

ApostropheCMS Seo <= 1.4.2; @apostrophecms/seo (npm) <= 1.4.2, SEMVER:introduced=0,fixed=1.5.0.

Q: Is there a fix for CVE-2026-53608?

Yes. @apostrophecms/seo (npm): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53608 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-53608?

Check whether you run ApostropheCMS Seo or @apostrophecms/seo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53608 · Severity: high · CVSS 8.7 · Published 2026-06-12

ApostropheCMS SEO is a module used to manage search engine optimization settings for websites. A security flaw allows users with content editor privileges to inject malicious scripts into the website's Google Analytics or Tag Manager configuration. If exploited, these scripts will execute in the browsers of all site visitors, potentially leading to the theft of administrator login sessions, full account takeover, or the distribution of malware to customers.

Vendors: ApostropheCMS, npm.

Quick answers

Is CVE-2026-53608 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53608 being exploited in the wild.
How severe is CVE-2026-53608?: High severity, with a CVSS score of 8.7, published 12 June 2026.
Which products and versions are affected?: ApostropheCMS Seo <= 1.4.2; @apostrophecms/seo (npm) <= 1.4.2, SEMVER:introduced=0,fixed=1.5.0.
Is there a fix for CVE-2026-53608?: Yes. @apostrophecms/seo (npm): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53608 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53608?: Check whether you run ApostropheCMS Seo or @apostrophecms/seo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@apostrophecms/seo (npm): upgrade to 1.5.0 or later
```
npm install @apostrophecms/seo@1.5.0
```

Technical details

A Stored XSS vulnerability exists in @apostrophecms/seo versions 1.4.2 and earlier. The module injects the 'seoGoogleTrackingId' and 'seoGoogleTagManager' fields directly into <script> tag bodies using JavaScript template literals without sanitization or validation in 'lib/nodes.js'. Because ApostropheCMS's permission model allows users with the 'editor' role to modify global settings, an authenticated attacker can inject arbitrary JavaScript. This payload is then rendered verbatim on every page of the site for all visitors. The issue is addressed in version 1.5.0 by implementing proper escaping and validation for these fields.

Affected products

ApostropheCMS @apostrophecms/seo <= 1.4.2

Identifiers

CVE-2026-53608
GHSA-wf43-fpp3-cf65

Timeline

2026-06-11: disclosed
2026-06-12: advisory: NVD publication date
2026-07-31: patched: GitHub Advisory reviewed and updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.