CVE-2026-53608: ApostropheCMS @apostrophecms/seo stored XSS in Google Tracking IDs

Executive brief

ApostropheCMS SEO is a module used to manage search engine optimization settings for websites. A security flaw allows users with content editor privileges to inject malicious scripts into the website's Google Analytics or Tag Manager configuration. If exploited, these scripts will execute in the browsers of all site visitors, potentially leading to the theft of administrator login sessions, full account takeover, or the distribution of malware to customers.

Technical details

A Stored XSS vulnerability exists in @apostrophecms/seo versions 1.4.2 and earlier. The module injects the 'seoGoogleTrackingId' and 'seoGoogleTagManager' fields directly into <script> tag bodies using JavaScript template literals without sanitization or validation in 'lib/nodes.js'. Because ApostropheCMS's permission model allows users with the 'editor' role to modify global settings, an authenticated attacker can inject arbitrary JavaScript. This payload is then rendered verbatim on every page of the site for all visitors. The issue is addressed in version 1.5.0 by implementing proper escaping and validation for these fields.

Affected products

• ApostropheCMS @apostrophecms/seo <= 1.4.2

Timeline

• 2026-06-11: disclosed
• 2026-06-12: advisory: NVD publication date
• 2026-07-31: patched: GitHub Advisory reviewed and updated with patch information

References

• https://api.github.com/users/H3xV0rT3x
• https://github.com/H3xV0rT3x
• https://api.github.com/users/H3xV0rT3x/gists%7B/gist_id%7D
• https://api.github.com/users/H3xV0rT3x/repos
• https://avatars.githubusercontent.com/u/123746403?v=4
• https://api.github.com/users/H3xV0rT3x/events%7B/privacy%7D