~ / search / GHSA-vx89-p3j7-8xqc

GHSA-vx89-p3j7-8xqc

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-71435

Packages

EcosystemPackageAffectedFixed in
Packagist statamic/cms < 5.74.3 5.74.3
Packagist statamic/cms >= 6.0.0, < 6.24.2 6.24.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients ### Patches This has been fixed in 5.74.3 and 6.24.2.

References

External links from the advisory. They lead to third-party sites.