decap-cms
3.17.3A Git-based CMS for Static Site Generators
- Maintenance
- Active187 commits in 3 months · bus factor 4
- License
- MITPermissive · OSI-approved
- Security
- 6 advisories2 critical, 2 high, 1 medium, 1 low
- Supported versions
- No scheduleendoflife.date does not track this project
19.5k stars · 3.1k forks · 422 open issues · last release 20 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 6 most recent advisories published by the maintainers: 2 critical, 2 high, 1 medium, 1 low. Check the patched version against the one you run.
- mediumGHSA-qf66-gqh8-qvrhOct 26, 2026File widget preview opened unsaved SVG media as a same-origin page (stored XSS)
- Affected
- <= 3.5.6; <= 3.17.2
- Patched in
- 3.5.7; 3.17.3
- highGHSA-38w6-4fqr-x68qOct 26, 2026Markdown and richtext previews rendered unsanitized HTML by default (stored XSS)
- Affected
- < 3.9.0; < 3.3.0; < 3.13.0
- Patched in
- 3.9.0; 3.3.0; 3.13.0
- highGHSA-fmjm-vjmx-5xhqOct 26, 2026Repository-controlled JavaScript front matter executes in the authenticated Decap CMS origin
- Affected
- <= 3.20.1; <= 3.17.1
- Patched in
- 3.20.2; 3.17.2
- criticalGHSA-g884-37w2-8475Oct 26, 2026decap-server: unauthenticated network exposure and .git writes allow command execution
- Affected
- <= 3.11.5; <= 0.1.2
- Patched in
- 3.11.6; 0.1.3
- criticalCVE-2026-92812Sep 1, 2026decap-server local_git path traversal via prefix-based repository boundary check allows out-of-repository read, write, and delete
- Affected
- <= 3.10.0
- Patched in
- 3.11.0
- lowGHSA-jm5q-pq3r-26g9Sep 1, 2026Bitbucket OAuth refresh token exposed in request URL
- Affected
- >= 2.5.0-beta.0, <= 3.2.1; >= 2.11.0-beta.0, <= 3.15.1; >= 2.16.0-beta.0, <= 3.15.1
- Patched in
- 3.3.0; 3.16.0