CVE-2025-57520

Vulnerability

Overview A stored cross-site scripting (XSS) vulnerability has been discovered in Decap CMS through version 3.8.3. The root cause is insufficient sanitization of user-supplied input in multiple content fields—including body, tags, title, and description—before they are rendered in the content preview pane [1][3].

Exploitation

An attacker with low-level contributor or editor privileges can craft a malicious entry containing JavaScript payloads (e.g., ``) in any of the vulnerable fields. The payload is stored in the CMS and triggers automatically whenever a privileged user, such as an admin, opens that entry in the preview panel [3]. No additional user interaction is required beyond viewing the infected content [1].

Impact

Successful exploitation allows arbitrary JavaScript execution in the browser context of the victim administrator. This can lead to session hijacking, credential theft, content defacement, or injection of backdoors into the generated static site output [3]. Because the vulnerability affects multiple input vectors, an attacker has considerable flexibility in choosing which field to poison.

Mitigation

As of this writing, no official patch has been released for the vulnerability. Users of Decap CMS versions 3.8.3 or earlier are advised to restrict access to the editor panel to trusted users only, or to implement a web application firewall (WAF) rule that filters common XSS payloads in the affected fields [3].