{"answers":{"affected":"2 open source packages ship an affected version, including j0k3r/graby.","exploited":"There is no known exploitation of GHSA-3h6j-9x8m-rg3g in the wild and no public exploit code.","fix":"Upgrade j0k3r/graby to 2.5.1 or later.","what":"GHSA-3h6j-9x8m-rg3g is a cross-site scripting vulnerability in j0k3r/graby, published on 31 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-3h6j-9x8m-rg3g and fix it if it is affected.\n\nWhat it is: GHSA-3h6j-9x8m-rg3g is a cross-site scripting vulnerability in j0k3r/graby, published on 31 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-3h6j-9x8m-rg3g in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- j0k3r/graby (Packagist): affected all versions; fixed in 2.5.1\n- j0k3r/graby (Packagist): affected all versions; fixed in 2.5.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-3h6j-9x8m-rg3g/ (Markdown: https://insights.sbomify.com/GHSA-3h6j-9x8m-rg3g/index.md)","id":"GHSA-3h6j-9x8m-rg3g","markdown":"https://insights.sbomify.com/GHSA-3h6j-9x8m-rg3g/index.md","name":"GHSA-3h6j-9x8m-rg3g","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["code_execution","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"PHP content extraction library","requires_auth":"low_privilege","summary":"Stored XSS in Graby library allows arbitrary JavaScript execution via unsanitized iframe srcdoc attributes when content is rendered raw.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nGraby's `cleanupXss()` function configures htmLawed with conflicting settings: `safe=1` (which removes `\u003ciframe\u003e`) combined with `'elements' =\u003e '*+iframe-meta'` (which re-enables `\u003ciframe\u003e`). htmLawed does not sanitize the `srcdoc` attribute, allowing injection of arbitrary JavaScript that executes when the content is rendered via `|raw` in templates.\n\n## Root Cause\n\n**`src/Graby.php` lines 1038-1048:**\n```php\nhtmLawed($html, [\n    'safe' =\u003e 1,                    // removes \u003ciframe\u003e\n    'elements' =\u003e '*+iframe-meta',  // re-adds \u003ciframe\u003e, overrides safe=1\n    'deny_attribute' =\u003e 'style',    // srcdoc is NOT denied\n]);\n```\n\nThe `safe=1` and `+iframe` combination is a conflict: `safe` mode is designed to strip dangerous elements, but the elements override re-enables `\u003ciframe\u003e` without also blocking the dangerous `srcdoc` attribute.\n\n## Proof of Concept\n\nInput to `cleanupXss()`:\n```html\n\u003ciframe srcdoc=\"\u0026lt;script\u0026gt;alert(document.domain)\u0026lt;/script\u0026gt;\"\u003e\u003c/iframe\u003e\n```\n\nOutput (unchanged — htmLawed passes it through):\n```html\n\u003ciframe srcdoc=\"\u0026lt;script\u0026gt;alert(document.domain)\u0026lt;/script\u0026gt;\"\u003e\u003c/iframe\u003e\n```\n\nWhen rendered via `{{ content|raw }}` in a template, `srcdoc` executes in an `about:srcdoc` frame with the same origin as the page. **Confirmed via Puppeteer/Chromium headless: `alert(document.domain)` fires.**\n\nValidated on Wallabag (which uses Graby) via Docker: entry created via API with iframe-only content body triggers Readability failure → falls through to `cleanupXss()` path.\n\n## Impact\n\n- Stored XSS in any application rendering Graby-sanitized content via `|raw`\n- In Wallabag: affects both authenticated views and public share pages (unauthenticated)\n- No CSP headers in default Wallabag config — no secondary mitigation\n\n## Suggested Fix\n\nEither remove `+iframe` from the elements config to keep iframes blocked:\n```php\n'elements' =\u003e '*-iframe-meta',\n```\n\nOr explicitly deny the `srcdoc` attribute:\n```php\n'deny_attribute' =\u003e 'style srcdoc',\n```\n\n## Credit\n\nDiscovered by @tikket1, 2026-03-25. Redirected from wallabag/wallabag advisory by @j0k3r.","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config","id":"GHSA-3h6j-9x8m-rg3g","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["2.5.1"],"introduced":["0"],"last_affected":[],"package":"j0k3r/graby","purl":null,"source":"GHSA-3h6j-9x8m-rg3g"},{"ecosystem":"Packagist","fixed":["2.5.1"],"introduced":["0"],"last_affected":[],"package":"j0k3r/graby","purl":"pkg:composer/j0k3r/graby","source":"GHSA-3h6j-9x8m-rg3g"}],"products":null,"published":"2026-03-31","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Stored XSS in Graby library allows arbitrary JavaScript execution via unsanitized iframe srcdoc attributes when content is rendered raw.","url":"https://insights.sbomify.com/GHSA-3h6j-9x8m-rg3g/"}