## Summary An attacker with only a GitHub account can plant a JavaScript payload in a `craftcms/cms` issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session. No control panel account or elevated privileges are required on the attacker’s side. ## Preconditions - Attacker has a GitHub account (no control panel access needed). - Victim is an administrator, and you have the CraftSupport widget on the dashboard. - Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue. ## Root cause `CraftSupportWidget.js` lines 382-392: ```js $('<a>', { href: this.getSearchResultUrl(results[i]), target: '_blank', html: '<span class="status ' + this.getSearchResultStatus(results[i]) + '"></span>' + this.getSearchResultText(results[i]), }) ``` `FeedbackScreen.getSearchResultText` (line 669-671) returns `result.title` verbatim from the GitHub API response. The jQuery `html:` option sets the element’s `innerHTML`, so a title containing `<img src=x onerror=...>` executes immediately on render. The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step. `HelpScreen` (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them. ## Steps to reproduce **Plant (attacker, GitHub account only):** 1. Open `https://github.com/craftcms/cms/issues/new`. 2. Set the title to a string combining a plausible search term and the payload, e.g.: ``` <img src=x onerror=alert(document.domain)> cannot upload files ``` 3. Submit the issue. **Trigger (victim, Craft admin):** 1. Open the Craft control panel dashboard. 2. Open the CraftSupport widget, click "Give feedback". 3. Type `cannot upload files` in the search box. 4. `alert(document.domain)` fires in the admin's session. ## Impact XSS in the admin control panel session. The payload has access to `Craft.csrfTokenName` and `Craft.csrfTokenValue` and can send same-origin action requests as the admin without any further interaction. ## Mitigating factors - Victim must actively use the "Give feedback" search screen. - Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match. - Widget is only available to admins. ## Resources https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417
## Summary An attacker with only a GitHub account can plant a JavaScript payload in a `craftcms/cms` issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session. No control panel account or elevated privileges are required on the attacker’s side. ## Preconditions - Attacker has a GitHub account (no control panel access needed). - Victim is an administrator, and you have the CraftSupport widget on the dashboard. - Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue. ## Root cause `CraftSupportWidget.js` lines 382-392: ```js $('<a>', { href: this.getSearchResultUrl(results[i]), target: '_blank', html: '<span class="status ' + this.getSearchResultStatus(results[i]) + '"></span>' + this.getSearchResultText(results[i]), }) ``` `FeedbackScreen.getSearchResultText` (line 669-671) returns `result.title` verbatim from the GitHub API response. The jQuery `html:` option sets the element’s `innerHTML`, so a title containing `<img src=x onerror=...>` executes immediately on render. The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step. `HelpScreen` (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them. ## Steps to reproduce **Plant (attacker, GitHub account only):** 1. Open `https://github.com/craftcms/cms/issues/new`. 2. Set the title to a string combining a plausible search term and the payload, e.g.: ``` <img src=x onerror=alert(document.domain)> cannot upload files ``` 3. Submit the issue. **Trigger (victim, Craft admin):** 1. Open the Craft control panel dashboard. 2. Open the CraftSupport widget, click "Give feedback". 3. Type `cannot upload files` in the search box. 4. `alert(document.domain)` fires in the admin's session. ## Impact XSS in the admin control panel session. The payload has access to `Craft.csrfTokenName` and `Craft.csrfTokenValue` and can send same-origin action requests as the admin without any further interaction. ## Mitigating factors - Victim must actively use the "Give feedback" search screen. - Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match. - Widget is only available to admins. ## Resources https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417
Update craftcms/cms to 4.17.16; craftcms/cms to 5.9.23 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanCraft CMS: DOM XSS via GitHub issue title in CraftSupport widget affects craftcms/cms (composer), craftcms/cms (composer). Severity is high. ## Summary An attacker with only a GitHub account can plant a JavaScript payload in a `craftcms/cms` issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session. No control panel account or elevated privileges are required on the attacker’s side. ## Preconditions - Attacker has a GitHub account (no control panel access needed). - Victim is an administrator, and you have the CraftSupport widget on the dashboard. - Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue. ## Root cause `CraftSupportWidget.js` lines 382-392: ```js $('<a>', { href: this.getSearchResultUrl(results[i]), target: '_blank', html: '<span class="status ' + this.getSearchResultStatus(results[i]) + '"></span>' + this.getSearchResultText(results[i]), }) ``` `FeedbackScreen.getSearchResultText` (line 669-671) returns `result.title` verbatim from the GitHub API response. The jQuery `html:` option sets the element’s `innerHTML`, so a title containing `<img src=x onerror=...>` executes immediately on render. The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step. `HelpScreen` (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them. ## Steps to reproduce **Plant (attacker, GitHub account only):** 1. Open `https://github.com/craftcms/cms/issues/new`. 2. Set the title to a string combining a plausible search term and the payload, e.g.: ``` <img src=x onerror=alert(document.domain)> cannot upload files ``` 3. Submit the issue. **Trigger (victim, Craft admin):** 1. Open the Craft control panel dashboard. 2. Open the CraftSupport widget, click "Give feedback". 3. Type `cannot upload files` in the search box. 4. `alert(document.domain)` fires in the admin's session. ## Impact XSS in the admin control panel session. The payload has access to `Craft.csrfTokenName` and `Craft.csrfTokenValue` and can send same-origin action requests as the admin without any further interaction. ## Mitigating factors - Victim must actively use the "Give feedback" search screen. - Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match. - Widget is only available to admins. ## Resources https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| craftcms/cmscomposer | >=4.0.0-RC1,<4.17.15 | 4.17.16 |
| craftcms/cmscomposer | >=5.0.0-RC1,<5.9.22 | 5.9.23 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate craftcms/cms to 4.17.16; craftcms/cms to 5.9.23 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanCraft CMS: DOM XSS via GitHub issue title in CraftSupport widget affects craftcms/cms (composer), craftcms/cms (composer). Severity is high. ## Summary An attacker with only a GitHub account can plant a JavaScript payload in a `craftcms/cms` issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session. No control panel account or elevated privileges are required on the attacker’s side. ## Preconditions - Attacker has a GitHub account (no control panel access needed). - Victim is an administrator, and you have the CraftSupport widget on the dashboard. - Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue. ## Root cause `CraftSupportWidget.js` lines 382-392: ```js $('<a>', { href: this.getSearchResultUrl(results[i]), target: '_blank', html: '<span class="status ' + this.getSearchResultStatus(results[i]) + '"></span>' + this.getSearchResultText(results[i]), }) ``` `FeedbackScreen.getSearchResultText` (line 669-671) returns `result.title` verbatim from the GitHub API response. The jQuery `html:` option sets the element’s `innerHTML`, so a title containing `<img src=x onerror=...>` executes immediately on render. The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step. `HelpScreen` (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them. ## Steps to reproduce **Plant (attacker, GitHub account only):** 1. Open `https://github.com/craftcms/cms/issues/new`. 2. Set the title to a string combining a plausible search term and the payload, e.g.: ``` <img src=x onerror=alert(document.domain)> cannot upload files ``` 3. Submit the issue. **Trigger (victim, Craft admin):** 1. Open the Craft control panel dashboard. 2. Open the CraftSupport widget, click "Give feedback". 3. Type `cannot upload files` in the search box. 4. `alert(document.domain)` fires in the admin's session. ## Impact XSS in the admin control panel session. The payload has access to `Craft.csrfTokenName` and `Craft.csrfTokenValue` and can send same-origin action requests as the admin without any further interaction. ## Mitigating factors - Victim must actively use the "Give feedback" search screen. - Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match. - Widget is only available to admins. ## Resources https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| craftcms/cmscomposer | >=4.0.0-RC1,<4.17.15 | 4.17.16 |
| craftcms/cmscomposer | >=5.0.0-RC1,<5.9.22 | 5.9.23 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard