GitHub Advisoryadvisory · npm

GHSA-xp8g-32qh-mv28 Decap CMS Cross Site Scripting (XSS) vulnerability

MEDIUM Published 2025-09-10 Modified 2025-09-23 Official page ↗
Aliases
CVE-2025-57520
Ecosystem
npm
Packages
decap-cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-09-10

Affected packages

• npm decap-cms: <= 3.8.3 (no fix yet)

Description

Decap CMS through 3.8.3 is vulnerable to stored Cross-Site Scripting (XSS) in the admin preview pane. User-controlled fields (e.g., title, description, tags, and body) are rendered in the preview without sufficient sanitization/escaping. An attacker with low-privilege author/contributor access can persist a JavaScript payload in content; when a maintainer or reviewer opens the preview, the payload executes in the CMS admin origin, enabling token/session theft or the execution of privileged actions via the DOM. The issue affects multiple input vectors and requires only passive interaction from the previewing user. As no patched version is available, administrators should restrict untrusted contributor roles and filter or disable preview rendering of untrusted HTML.

Related

Alias · CVE (1)

  • CVE-2025-57520 A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References