Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-49276: Uptime‑Kuma can run malicious code via Google Analytics field

CVE-2023-49276 · published 2 years ago

Summary

The self‑hosted monitoring tool Uptime‑Kuma lets an attacker inject code through the custom Google Analytics ID setting, which can execute unwanted scripts in a user’s browser. This occurs because the entered value isn’t cleaned before being placed into the page. Updating to version 1.23.7 or later fixes the problem; there is no safe workaround other than upgrading.

What to do

Update louislam uptime-kuma to version 1.23.7.
Update uptime.kuma uptime_kuma to version 1.23.7 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	louislam	uptime-kuma	>= 1.20.0, <= 1.23.6 Fix: upgrade to 1.23.7
–	uptime.kuma	uptime_kuma	>= 1.20.0, < 1.23.7 `cpe:2.3:a:uptime.kuma:uptime_kuma::::::::`

Original advisory text

Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. This vulnerability has been addressed in commit `f28dccf4e` which is included in release version 1.23.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

https://github.com/advisories/GHSA-v4v2-8h88-65qj
https://github.com/louislam/uptime-kuma/security/advisories/GHSA-v4v2-8h88-65qj Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-49276 Vendor Advisory
https://github.com/louislam/uptime-kuma/commit/f28dccf4e11f041564293e4f407e69ab9... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49276... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published1 Dec 2023

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-v4v2-8h88-65qj · GHSA

CVE-2023-49276 · NVD

CVE-2023-49276 · OSV

Track software like this

Free during beta