CVE-2025-57520 PoC — decap-cms 安全漏洞

Source

https://github.com/onurcangnc/CVE-2025-57520-Stored-XSS-in-Decap-CMS-3.8.3-

Associated Vulnerability

Title:decap-cms 安全漏洞 (CVE-2025-57520)
Description:decap-cms是Decap CMS开源的一个基于Git的静态站点生成器。 decap-cms 3.8.3及之前版本存在安全漏洞，该漏洞源于跨站脚本，可能导致执行任意JavaScript。

Description

A stored cross-site scripting (XSS) vulnerability exists in Decap CMS up to version 3.8.3.   The issue affects multiple input fields in the **admin interface** and is triggered when a privileged user opens the **content preview panel** of a malicious entry.

File Snapshot


 [4.0K]  /data/pocs/3d02c01001bb02b3443db423c9429ddcd8ca9f44
├── [1.9K]  readme.MD
└── [4.0K]  screenshots
    ├── [1.2M]  vulnerable2.png
    └── [ 81K]  vulnerable.png

1 directory, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!