CVE-2026-56383 Craft CMS - Stored XSS in Table Field via Row Heading Column Type
An administrator can inject JavaScript into Craft CMS table fields, leading to script execution for other users viewing the page.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-56383?
CVE-2026-56383 is a medium-severity cross-site scripting vulnerability in craftcms cms, published on 21 Jun 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.
Weakness: CWE-79
Which versions are affected by CVE-2026-56383?
4 open source packages ship an affected version, including craftcms/cms.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 4.5.0-beta.1 | 4.16.19 |
craftcms/cms Packagist | From 4.5.0-beta.1 | 4.16.19 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.8.23 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.8.23 |
How do I fix CVE-2026-56383?
Upgrade craftcms/cms to a fixed version for your release line: 4.16.19 or 5.8.23.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-56383 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56383 exists.
Sources
Also known as GHSA-6j87-m5qx-9fqp.