GHSA-4r9c-jghc-cx5m

Cross-site Scripting in apostrophe

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-25978

Packages

Ecosystem	Package	Affected	Fixed in
npm	apostrophe	>= 2.63.0, < 3.4.0	3.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-25978 advisory
https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59 web
https://github.com/apostrophecms/apostrophe package