Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `<script>` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-53608 ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics… https://www.cve.org/CVERecord?id=CVE-2026-53608
Post summary
The CVE-2026-53608 disclosure notes that ApostropheCMS’s seo package up to version 1.4.2 injects Google Analytics code, but no PoC, exploit, or mitigation details are provided.
#CVE-2026-53608 - Stored XSS in ApostropheCMS #SEO package. Editor-level users can inject malicious script via Google Analytics/Tag Manager IDs. CVSS 8.7. No patch available. Review access controls immediately. #ApostropheCMS #InfoSec #canada More #cybersecurity https://www.valtersit.com/cve/CVE-2026-53608
Post summary
ApostropheCMS SEO package suffers a stored XSS vulnerability (CVE-2026-53608) that allows editor-level users to inject scripts via Google Analytics/Tag Manager IDs. CVSS 8.7, no patch available—administrators should review access controls immediately.