HighGHSA-2v88-qq7x-xq5fCVE-2021-39170
Improper Encoding or Escaping of Output in Asset Metadata Component
Published 1 Sept 2021 · Updated 8 Jul 2026
Affected package
pimcore/pimcoreComposer
- Affected
- <10.1.2
- Fixed in
- 10.1.2
Update to the fixed version for your release line, for example:
composer require pimcore/pimcore:^10.1.2Details
Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually.
Is GHSA-2v88-qq7x-xq5f in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/pimcore, and gives you the command that fixes it.
References
- Linkgithub.com/pimcore/pimcore/security/advisories/GHSA-2v88-qq7x-xq5f
- Advisorynvd.nist.gov/vuln/detail/CVE-2021-39170
- Linkgithub.com/pimcore/pimcore/pull/10178
- Linkgithub.com/pimcore/pimcore/pull/10178.patch
- Linkgithub.com/pimcore/pimcore/pull/10206
- Packagegithub.com/pimcore/pimcore
- Linkhuntr.dev/bounties/c3e4cf79-a4b5-4982-af27-729f66281501
- Linkhuntr.dev/bounties/e4cb9cd8-89cf-427c-8d2e-37ca40099bf2
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.