Decap CMS Cross Site Scripting (XSS) vulnerability

Description

Decap CMS through 3.8.3 is vulnerable to stored Cross-Site Scripting (XSS) in the admin preview pane. User-controlled fields (e.g., title, description, tags, and body) are rendered in the preview without sufficient sanitization/escaping.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 3.8.3

References

• GHSA-xp8g-32qh-mv28
• onurcangenc.com.tr
• CVE-2025-57520
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - CVE-2025-58064
• Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component - CVE-2025-8082
• CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - ckeditor5 - CVE-2025-58064
• QMarkdown Cross-Site Scripting (XSS) vulnerability - CVE-2025-43954

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

decap-cms