CVE-2025-57520 – Stored XSS in Decap CMS (<= 3.8.3)

A stored cross-site scripting (XSS) vulnerability exists in Decap CMS up to version 3.8.3.
The issue affects multiple input fields in the admin interface and is triggered when a privileged user opens the content preview panel of a malicious entry.

Vulnerability Summary

• CVE ID: CVE-2025-57520
• Type: Stored Cross-Site Scripting (XSS)
• Affected Versions: Decap CMS <= 3.8.3
• Affected Component: Admin Panel → Content Preview (title, tags, description, body)
• Impact: Session hijacking, credential theft, arbitrary JavaScript execution
• Discoverer: Onurcan Genç – Independent Security Researcher

Proof of Concept (PoC)

Payload Example

">

Steps

1. Login as Contributor/Editor (low privilege).

2. Create a new blog entry.

3. Insert the payload into one of the vulnerable fields (e.g., title).

4. Save the entry.

5. Login as Admin (high privilege).

6. Open the entry in Preview.

7. Payload executes in the admin’s browser context.

Screenshot

Vulnerable fields

Admin opens preview → payload executes:

Impact

• Stored XSS in multiple fields (title, tags, description, body)
• Arbitrary JavaScript execution in admin/editor sessions
• Can lead to:
  • Session hijacking
  • Credential theft
  • Content defacement
  • Backdoor injection into generated websites

References

• Blog Advisory: Decap CMS XSS Analysis
• CVE Record: CVE-2025-57520 (currently RESERVED)
• Decap CMS GitHub: decaporg/decap-cms