CVE-2026-53608: @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

Vulnerability summary

CVE-2026-53608 is a high (CVSS 8.7) Cross-site Scripting vulnerability in apostrophecms @apostrophecms/seo. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.7% of scored vulnerabilities.

Timeline

1. 12-06-2026
   PublishedVulnerability first disclosed.
2. 15-06-2026
   Last modifiedVulnerability information updated.

Description

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `<script>` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.