~ / search / GHSA-6268-v434-45m5

GHSA-6268-v434-45m5

Cross-site Scripting in Grav

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-16126

Packages

EcosystemPackageAffectedFixed in
Packagist getgrav/grav < 1.7.0-beta.8 1.7.0-beta.8

Details

As written in the advisory (Markdown source, shown as plain text).

Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.

References

External links from the advisory. They lead to third-party sites.