GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-g59r-24g3-h7cmhigh8.0

Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation

Impact

Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.

Source excerpt · OSV
Applies when

The attack requires:

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

statamic/cms Packagist
Affected rangeRecorded fix
Earlier releases before 5.22.1Ecosystem versions5.22.1

Version evidence: OSV · GHSA-g59r-24g3-h7cm

View original version evidence (407 explicit versions)

Original source description

Impact

Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.

This affects:

  • Control panel users with permission to create or edit Collections and Taxonomies
  • Versions up to and including 5.22.0

The vulnerability can be exploited to:

  • Change a super admin's password (versions ≤ 5.21.0)
  • Change a super admin's email address to initiate password reset (version 5.22.0)
  • Gain unauthorized access to superadmin accounts

The attack requires:

  • An authenticated user with control panel and content creation permissions
  • A super admin to view the compromised content

Patches

This has been fixed in 5.22.1.

Credits

Statamic thanks Wojtek Chwala for responsibly reporting the identified issues and working with us as we addressed them.

References