{"answers":{"affected":"2 open source packages ship an affected version, including mckenziearts/livewire-markdown-editor.","exploited":"There is no known exploitation of GHSA-gxxh-8vcj-w2mh in the wild and no public exploit code.","fix":"Upgrade mckenziearts/livewire-markdown-editor to 1.3 or later.","what":"GHSA-gxxh-8vcj-w2mh is a vulnerability in mckenziearts/livewire-markdown-editor, published on 4 May 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-gxxh-8vcj-w2mh and fix it if it is affected.\n\nWhat it is: GHSA-gxxh-8vcj-w2mh is a vulnerability in mckenziearts/livewire-markdown-editor, published on 4 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-gxxh-8vcj-w2mh in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- mckenziearts/livewire-markdown-editor (Packagist): affected all versions; fixed in 1.3\n- mckenziearts/livewire-markdown-editor (Packagist): affected all versions; fixed in 1.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-gxxh-8vcj-w2mh/ (Markdown: https://insights.sbomify.com/GHSA-gxxh-8vcj-w2mh/index.md)","id":"GHSA-gxxh-8vcj-w2mh","markdown":"https://insights.sbomify.com/GHSA-gxxh-8vcj-w2mh/index.md","name":"GHSA-gxxh-8vcj-w2mh","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Livewire markdown editor","requires_auth":"low_privilege","summary":"Authenticated users can upload malicious files to achieve stored XSS or code execution due to missing validation in the Livewire markdown editor package.","user_interaction":"not_required","vuln_class":"file_upload"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nAll versions of `mckenziearts/livewire-markdown-editor` prior to **v1.3** contain a critical arbitrary file upload vulnerability in the `MarkdownEditor::updatedAttachments()` Livewire handler. The handler calls `$file-\u003estore()` with no server-side validation of MIME type, extension, or file content.\n\nAny authenticated user with access to a page embedding `\u003clivewire:markdown-editor\u003e` can upload files of any type (`.html`, `.svg`, `.js`, `.php`, `.exe`, etc.) to the disk configured by `livewire-markdown-editor.disk`. When that disk is a public cloud bucket (S3, DigitalOcean Spaces, Cloudflare R2, Scaleway Object Storage — the common configuration when `FILESYSTEM_DISK` points to such a disk), uploaded files are served publicly with a guessed `Content-Type` header.\n\nThe consequences include:\n\n- **Stored XSS** on the storage domain via uploaded `.html` or `.svg` files\n- **Phishing page hosting** on the application's own storage domain (trust laundering)\n- **Malware distribution** from a domain users associate with the application\n- **Markdown injection** in the editor output via crafted filenames (the client-supplied `getClientOriginalName()` value was inserted verbatim into the markdown)\n\nA real-world exploitation of this vulnerability was observed in production on a community platform using this package.\n\n### Patches\n\nUpgrade to **v1.3** or later.\n\n### Workarounds\n\nIf developers cannot upgrade immediately, disable the upload UI on every instance of the editor by passing `:show-upload=\"false\"`:\n\n```blade\n  \u003clivewire:markdown-editor wire:model=\"content\" :show-upload=\"false\" /\u003e\n```\n\nThis hides the file input and prevents the vulnerable code path from being reached.\n\n### Resources\n\n- Patch commit: https://github.com/mckenziearts/livewire-markdown-editor/pull/12\n- Release: https://github.com/mckenziearts/livewire-markdown-editor/releases/tag/v1.3\n- CWE-434: https://cwe.mitre.org/data/definitions/434.html\n- CWE-79: https://cwe.mitre.org/data/definitions/79.html","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler","id":"GHSA-gxxh-8vcj-w2mh","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"file_upload","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["1.3"],"introduced":["0"],"last_affected":[],"package":"mckenziearts/livewire-markdown-editor","purl":null,"source":"GHSA-gxxh-8vcj-w2mh"},{"ecosystem":"Packagist","fixed":["1.3"],"introduced":["0"],"last_affected":[],"package":"mckenziearts/livewire-markdown-editor","purl":"pkg:composer/mckenziearts/livewire-markdown-editor","source":"GHSA-gxxh-8vcj-w2mh"}],"products":null,"published":"2026-05-04","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated users can upload malicious files to achieve stored XSS or code execution due to missing validation in the Livewire markdown editor package.","url":"https://insights.sbomify.com/GHSA-gxxh-8vcj-w2mh/"}