GHSA-wmh9-x28j-c6gr
Cross site scripting in publify
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| RubyGems | publify_core | >= 8.0, < 9.2.5 | 9.2.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a “publisher” role is able to inject and execute arbitrary JavaScript code while creating a page/article.
References
External links from the advisory. They lead to third-party sites.