Vulnerability Description
A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3. Input fields such as body, tags, title, and description are not properly sanitized before being rendered in the content preview pane. This enables an attacker to inject arbitrary JavaScript which executes whenever a user views the preview panel. The vulnerability affects multiple input vectors and does not require user interaction beyond viewing the affected content.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Techhub.P-M | Decap Cms | <= 3.8.3 |
Related Weaknesses (CWE)
References
- https://github.com/decaporg/decap-cmsProduct
- https://onurcangenc.com.tr/blog/decap-cms-xss-analysisBroken Link
- https://onurcangenc.com.tr/posts/cve-2025-57520--stored-xss-in-decap-cms-3-8-3/ExploitThird Party Advisory
- https://onurcangenc.com.tr/posts/cve-2025-57520--stored-xss-in-decap-cms-3-8-3/ExploitThird Party Advisory
FAQ
What is CVE-2025-57520?
CVE-2025-57520 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3. Input fields such as body, tags, title, and description are not properly sanitized before being rendered in the content previ...
How severe is CVE-2025-57520?
CVE-2025-57520 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-57520?
Check the references section above for vendor advisories and patch information. Affected products include: Techhub.P-M Decap Cms.