THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-wf43-fpp3-cf65 (high) — @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

[GHSA] GHSA-wf43-fpp3-cf65 (high) — @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

highgithub_advisoriesPublished 2026-07-31

GHSA-wf43-fpp3-cf65 Severity: high CVE: CVE-2026-53608

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

<img width="1919" height="1046" alt="curl" src="https://github.com/user-attachments/assets/8aa19ff1-7f4b-44ee-83d5-d0dd1a0269f6" /> <img width="1919" height="775" alt="xss" src="https://github.com/user-attachments/assets/a65012e8-9b

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-53608cve
http://TARGET/api/v1/@apostrophecms/login/loginurl
http://TARGET/api/v1/@apostrophecms/globalurl
http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_IDurl
http://TARGET/api/v1/@apostrophecms/global/GLOBAL_DRAFT_ID/publishurl

Original source: https://github.com/advisories/GHSA-wf43-fpp3-cf65