GHSA-424m-fj2q-g7vg
Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | aimeos/ai-cms-grapesjs | >= 2021.04.1, < 2021.10.8 | 2021.10.8 |
| Packagist | aimeos/ai-cms-grapesjs | >= 2022.04.1, < 2022.10.9 | 2022.10.9 |
| Packagist | aimeos/ai-cms-grapesjs | >= 2023.04.1, < 2023.10.15 | 2023.10.15 |
| Packagist | aimeos/ai-cms-grapesjs | >= 2024.04.1, < 2024.10.8 | 2024.10.8 |
| Packagist | aimeos/ai-cms-grapesjs | >= 2025.04.1, < 2025.10.2 | 2025.10.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled.
### Workaround
If the standard CSP rules are active (default in production mode), an exploit isn't possible.
### Credits
Lwin Min Oo <[email protected]>
References
External links from the advisory. They lead to third-party sites.