p PatchFirst

CVE-2025-57520

CVE-2025-57520

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3. Input fields such as body, tags, title, and description are not properly sanitized before being rendered in the content preview pane. This enables an attacker to inject arbitrary JavaScript which executes whenever a user views the preview panel. The vulnerability affects multiple input vectors and does not require user interaction beyond viewing the affected content.

CVSS 6.1 · Medium · EPSS 0.3% · Public exploit

Published
Updated

Stack: node

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • decap-cms npm

    Affected ranges
    • SEMVER: ≤ 3.8.3

    No fix published

Original sources

Check your server →