{"id":"GHSA-424m-fj2q-g7vg","aliases":["CVE-2025-66468"],"title":"Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"### Impact\n\nJavascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled.\n\n### Workaround\n\nIf the standard CSP rules are active (default in production mode), an exploit isn't possible.\n\n### Credits\n\nLwin Min Oo <lwinminoo2244@gmail.com>","severity":"high","score":7.6,"published":"2025-12-03T14:05:28.000Z","modified":"2025-12-03T14:27:33.103Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"aimeos/ai-cms-grapesjs","sources":[{"name":"OSV · GHSA-424m-fj2q-g7vg","url":"https://osv.dev/vulnerability/GHSA-424m-fj2q-g7vg"}],"ranges":[{"events":[{"introduced":"2021.04.1"},{"fixed":"2021.10.8"}],"type":"ECOSYSTEM"}],"versions":["2021.04.1","2021.04.2","2021.04.3","2021.04.4","2021.04.5","2021.04.6","2021.07.1","2021.07.2","2021.07.3","2021.07.4","2021.07.5","2021.07.6","2021.07.7","2021.10.1","2021.10.2","2021.10.3","2021.10.4","2021.10.5","2021.10.6","2021.10.7"],"fixed":["2021.10.8"]},{"ecosystem":"Packagist","name":"aimeos/ai-cms-grapesjs","sources":[{"name":"OSV · GHSA-424m-fj2q-g7vg","url":"https://osv.dev/vulnerability/GHSA-424m-fj2q-g7vg"}],"ranges":[{"events":[{"introduced":"2022.04.1"},{"fixed":"2022.10.9"}],"type":"ECOSYSTEM"}],"versions":["2022.04.1","2022.04.2","2022.04.3","2022.04.4","2022.07.1","2022.07.2","2022.07.3","2022.10.1","2022.10.2","2022.10.3","2022.10.4","2022.10.5","2022.10.6","2022.10.7","2022.10.8"],"fixed":["2022.10.9"]},{"ecosystem":"Packagist","name":"aimeos/ai-cms-grapesjs","sources":[{"name":"OSV · GHSA-424m-fj2q-g7vg","url":"https://osv.dev/vulnerability/GHSA-424m-fj2q-g7vg"}],"ranges":[{"events":[{"introduced":"2023.04.1"},{"fixed":"2023.10.15"}],"type":"ECOSYSTEM"}],"versions":["2023.04.1","2023.04.2","2023.07.1","2023.07.2","2023.07.3","2023.07.4","2023.10.1","2023.10.10","2023.10.11","2023.10.12","2023.10.13","2023.10.14","2023.10.2","2023.10.3","2023.10.4","2023.10.5","2023.10.6","2023.10.7","2023.10.8","2023.10.9"],"fixed":["2023.10.15"]},{"ecosystem":"Packagist","name":"aimeos/ai-cms-grapesjs","sources":[{"name":"OSV · GHSA-424m-fj2q-g7vg","url":"https://osv.dev/vulnerability/GHSA-424m-fj2q-g7vg"}],"ranges":[{"events":[{"introduced":"2024.04.1"},{"fixed":"2024.10.8"}],"type":"ECOSYSTEM"}],"versions":["2024.04.1","2024.04.2","2024.04.3","2024.04.4","2024.04.5","2024.04.6","2024.07.1","2024.07.2","2024.07.3","2024.10.1","2024.10.2","2024.10.3","2024.10.4","2024.10.5","2024.10.6","2024.10.7"],"fixed":["2024.10.8"]},{"ecosystem":"Packagist","name":"aimeos/ai-cms-grapesjs","sources":[{"name":"OSV · GHSA-424m-fj2q-g7vg","url":"https://osv.dev/vulnerability/GHSA-424m-fj2q-g7vg"}],"ranges":[{"events":[{"introduced":"2025.04.1"},{"fixed":"2025.10.2"}],"type":"ECOSYSTEM"}],"versions":["2025.04.1","2025.04.2","2025.07.1","2025.07.2","2025.10.1"],"fixed":["2025.10.2"]}],"sourceAffected":[],"references":["https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg","https://nvd.nist.gov/vuln/detail/CVE-2025-66468","https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042","https://github.com/aimeos/ai-cms-grapesjs"],"sources":[{"name":"OSV","id":"GHSA-424m-fj2q-g7vg","modified":"2025-12-03T14:27:33.103899Z","url":"https://osv.dev/vulnerability/GHSA-424m-fj2q-g7vg"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","score":7.6}],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T11:55:31.891Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}