GHSA-vf6x-59hh-332f Formwork has a cross-site scripting (XSS) vulnerability in Site title
Admins can inject JavaScript into the site title, causing XSS attacks and potential denial of service for all users.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-vf6x-59hh-332f?
GHSA-vf6x-59hh-332f is a cross-site scripting vulnerability in getformwork/formwork, published on 1 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Summary
The site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.
Impact
The attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.
Patches
- Formwork 2.x (aa3e9c6) escapes site title from panel header navigation.
Details
By embedding "<!–", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.
Which versions are affected by GHSA-vf6x-59hh-332f?
2 open source packages ship an affected version, including getformwork/formwork.
| Package | Affected | Fixed in |
|---|---|---|
getformwork/formwork Packagist | From 2.0.0-beta.3 | 2.0.0-beta.4 |
getformwork/formwork Packagist | From 2.0.0-beta.3 | 2.0.0-beta.4 |
How do I fix GHSA-vf6x-59hh-332f?
Upgrade getformwork/formwork to 2.0.0-beta.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-vf6x-59hh-332f being exploited?
There is no known exploitation of GHSA-vf6x-59hh-332f in the wild and no public exploit code.