GHSA-f546-v666-559x
Craft CMS Cross-site Scripting vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | craftcms/cms | >= 4.0.0-RC1, < 4.2.1 | 4.2.1 |
| Packagist | craftcms/cms | >= 3.7.39, < 3.7.51 | 3.7.51 |
Details
As written in the advisory (Markdown source, shown as plain text).
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line `label: elementInfo.label`.
References
External links from the advisory. They lead to third-party sites.