Read the docs
TI-2023-26912 Aliases CVE-2023-49276GHSA-v4v2-8h88-65qj

Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. This vulnerability has been addressed in commit `f28dccf4e` which is included in release version 1.23.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

EPSS 0.00497 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed uptime-kuma (louislam): 1.23.7uptime-kuma (npm): 1.23.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
louislamuptime-kuma1.20.0 to before 1.23.71.23.7Patch availableCNA
—uptime-kuma (npm)1.20.0 to before 1.23.71.23.7Patch availableGHSA-v4v2-8h88-65qj
  • uptime-kuma Vendorlouislam Affected 1.20.0 to before 1.23.7 Fixed in 1.23.7 Patch available CNA
  • uptime-kuma (npm) Vendor— Affected 1.20.0 to before 1.23.7 Fixed in 1.23.7 Patch available GHSA-v4v2-8h88-65qj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:uptime.kuma:uptime_kuma:*:*:*:*:*:*:*:*1.20.0 to before 1.23.7VulnerableUptime.kuma
  • cpe:2.3:a:uptime.kuma:uptime_kuma:*:*:*:*:*:*:*:* Versions 1.20.0 to before 1.23.7 Vulnerable ·Uptime.kuma

Remediation

  • Fix · CNA uptime-kuma (louislam) Fixed in 1.23.7
  • Fix · GHSA-v4v2-8h88-65qj uptime-kuma (npm) Fixed in 1.23.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49276
  2. 2026-10-03 Alias added: GHSA-v4v2-8h88-65qj

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-51249 Path traversal in louislam dockge CVSS 4.0HIGH 8.7
  • TI-2024-37292 Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor CVSS 3.1MEDIUM 6.8
  • TI-2026-49952 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages CVSS 3.1HIGH 8.1
  • TI-2026-83016 Race condition in Uptime Kuma lets attackers create extra admins CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences