GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-3wxg-w96j-8hq9low3.7

CraftCMS stored XSS in Quick Post widget error message

Impact

The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload.

Source excerpt · OSV

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

craftcms/cms Packagist
Affected rangeRecorded fix
From 4.0.0-RC1 before 4.4.6Ecosystem versions4.4.6
From 3.0.0 before 3.8.6Ecosystem versions3.8.6

Version evidence: OSV · GHSA-3wxg-w96j-8hq9

View original version evidence (475 explicit versions)

Original source description

Summary

The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload.

Details

Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save.

PoC

  1. Login at admin

  2. Go to setting

  3. Create a Section

  4. On Entry page, click Edit label

  5. Inject the XSS payload into the label and save

  6. On the admin dashboard choose new widget -> Quick Post

  7. In Quick Post, click save with blank slug; The XSS will be executed

    "errors":{"title":["<script>alert('nono')</script> cannot be blank."],"slug":["Slug cannot be blank."]

Fixed in https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888

References