Craft CMS Vulnerable to Stored XSS in Revision Context Menu
Published 18 Mar 2026 · Updated 20 Mar 2026
Affected package
- Affected
- >=5.9.0-beta.1 <5.9.11
- Fixed in
- 5.9.11
composer require craftcms/cms:^5.9.11Details
The revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the
use of Template::raw() combined with Craft::t() string interpolation. A low-privileged control panel user
(e.g., Author) can set their fullName to an XSS payload via the profile editor, then create an entry with two
saves.
If an administrator is logged in and executes a specifically crafted payload while an elevated session is active, the attacker’s account can be elevated to administrator.
Users should update to Craft 5.9.11 with the patch to mitigate the issue.
Is GHSA-3x4w-mxpf-fhqq in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.