Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma

published 2023-11-24 2 y ago modified 2026-09-10 1 mo ago also GHSA-v4v2-8h88-65qj , EUVD-2023-3036

cvss: 6.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits: 0; none known

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. This vulnerability has been addressed in commit `f28dccf4e` which is included in release version 1.23.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Patch / fix

fixed in 2 links 1

npm uptime-kuma 1.23.7
uptime.kuma uptime_kuma 1.23.7

github.com/louislam/uptime-kuma@f28dccf commit

Exploit prediction

0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/louislam/uptime-kuma/security/advisories/GHSA-v4v2-8h88-65qj referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
NVD	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	uptime-kuma	>=1.20.0, <1.23.7	1.23.7

Affected products

louislam uptime-kuma

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /louislam/uptime-kuma/commit/f28dccf4e11f041564293e4f407e69ab9ee2277f
web, patch
github.com /louislam/uptime-kuma/security/advisories/GHSA-v4v2-8h88-65qj
web, exploit, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2023-49276
advisory
github.com /louislam/uptime-kuma
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary