https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 10:49:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-332416 EUVD-2026-332416 https://cve.radiocsirt.org/vuln/euvd-2026-332416 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55790 <p>Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s &#34;Give feedback&#34; screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session. No control panel account or elevated privileges are required on the attacker’s side. This issue has been fixed in versions 4.17.16 and 5.9.23.</p> <p>Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s &#34;Give feedback&#34; screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session. No control panel account or elevated privileges are required on the attacker’s side. This issue has been fixed in versions 4.17.16 and 5.9.23.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55790 https://cve.radiocsirt.org/vuln/ghsa-24x4-j6x9-rfw5 <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>## Summary</p> <p>An attacker with only a GitHub account can plant a JavaScript payload in a `craftcms/cms` issue title. When a Craft admin uses the CraftSupport widget’s &#34;Give feedback&#34; screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.</p> <p>No control panel account or elevated privileges are required on the attacker’s side.</p> <p>## Preconditions</p> <p>- Attacker has a GitHub account (no control panel access needed). - Victim is an administrator, and you have the CraftSupport widget on the dashboard. - Victim uses the &#34;Give feedback&#34; screen and types a search term that returns the poisoned issue.</p> <p>## Root cause</p> <p>`CraftSupportWidget.js` lines 382-392:</p> <p>```js $(&#39;&lt;a&gt;&#39;, { href: this.getSearchResultUrl(results[i]), target: &#39;_blank&#39;, html: &#39;&lt;span class=&#34;status &#39; + this.getSearchResultStatus(results[i]) + &#39;&#34;&gt;&lt;/span&gt;&#39; + this.getSearchResultText(results[i]), }) ```</p> <p>`FeedbackScreen.getSearchResultText` (line 669-671) returns `result.title` verbatim from the GitHub API response. The jQuery `html:` option sets the element’s `innerHTML`, so a title containing `&lt;img src=x onerror=...&gt;` executes immediately on render.</p> <p>The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.</p> <p>`HelpScreen` (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning t…</p> <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>## Summary</p> <p>An attacker with only a GitHub account can plant a JavaScript payload in a `craftcms/cms` issue title. When a Craft admin uses the CraftSupport widget’s &#34;Give feedback&#34; screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.</p> <p>No control panel account or elevated privileges are required on the attacker’s side.</p> <p>## Preconditions</p> <p>- Attacker has a GitHub account (no control panel access needed). - Victim is an administrator, and you have the CraftSupport widget on the dashboard. - Victim uses the &#34;Give feedback&#34; screen and types a search term that returns the poisoned issue.</p> <p>## Root cause</p> <p>`CraftSupportWidget.js` lines 382-392:</p> <p>```js $(&#39;&lt;a&gt;&#39;, { href: this.getSearchResultUrl(results[i]), target: &#39;_blank&#39;, html: &#39;&lt;span class=&#34;status &#39; + this.getSearchResultStatus(results[i]) + &#39;&#34;&gt;&lt;/span&gt;&#39; + this.getSearchResultText(results[i]), }) ```</p> <p>`FeedbackScreen.getSearchResultText` (line 669-671) returns `result.title` verbatim from the GitHub API response. The jQuery `html:` option sets the element’s `innerHTML`, so a title containing `&lt;img src=x onerror=...&gt;` executes immediately on render.</p> <p>The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.</p> <p>`HelpScreen` (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning t…</p> https://cve.radiocsirt.org/vuln/ghsa-24x4-j6x9-rfw5