LowGHSA-6j87-m5qx-9fqpCVE-2026-56383

Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

Published 25 Feb 2026 · Updated 6 Aug 2026

Affected packages

craftcms/cmsComposer

Affected: >=4.5.0-beta.1 <4.16.19
Fixed in: 4.16.19

Update to the fixed version for your release line, for example:composer require craftcms/cms:^4.16.19

craftcms/cmsComposer

Affected: >=5.0.0-RC1 <5.8.23
Fixed in: 5.8.23

Update to the fixed version for your release line, for example:composer require craftcms/cms:^5.8.23

Details

A stored Cross-site Scripting (XSS) vulnerability exists in the editableTable.twig component when using the Row Heading column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field.

Prerequisites

An administrator account
allowAdminChanges must be enabled in production, which is against security recommendations.

Steps to Reproduce

1. Navigate to Settings → Fields and create a new field with Type: Table 1. Add a Column Heading and set Column Type to Row Heading 1. In Default Values section, add a row with the following payload:

    <img src=x onerror="alert('XSS')">

1. Enable Static Rows 1. Use the field in any object (e.g., user profile fields) → then visit any user’s profile 1. Notice the XSS execution

Resources

https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a

Is GHSA-6j87-m5qx-9fqp in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.