Back to Database
Status published
Medium
CVE-2023-32325
Cross-site scripting in PostHog-js
Vulnerability Description
PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cross-site scripting. Problem has been patched in 1.57.2. Users are advised to upgrade. Users unable to upgrade should ensure that their Content Security Policy is in place.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-32325
Credits & Attribution
No credits recorded in the NVD database.
References
More from PostHog
View All →CVE-2025-1522
PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability
High
7.1
CVE-2025-1521
PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability
High
7.1
CVE-2025-1520
PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability
High
7.1
CVE-2024-9710
PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability
High
7.1
CVE-2023-46746
Authenticated PostHog users vulnerable to SSRF
Medium
4.8
Affected Vendor
PostHog
View all reports →Affected Software
posthog-js
Vulnerable Versions:
< 1.57.2
Timeline
Official Publish:
May 26th, 2023
Last Modified:
January 14th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N