MediumGHSA-7733-hjv6-4h47BIT-typo3-2020-15241CVE-2020-15241

Cross-Site Scripting in ternary conditional operator

Published 8 Oct 2020 · Updated 10 Sept 2026

Affected packages

typo3fluid/fluidComposer

Affected: >=2.0.0 <2.0.5
Fixed in: 2.0.5

Update to the fixed version for your release line, for example:composer require typo3fluid/fluid:^2.0.5

typo3fluid/fluidComposer

Affected: >=2.1.0 <2.1.4
Fixed in: 2.1.4

Update to the fixed version for your release line, for example:composer require typo3fluid/fluid:^2.1.4

typo3fluid/fluidComposer

Affected: >=2.2.0 <2.2.1
Fixed in: 2.2.1

Update to the fixed version for your release line, for example:composer require typo3fluid/fluid:^2.2.1

typo3fluid/fluidComposer

Affected: >=2.3.0 <2.3.5
Fixed in: 2.3.5

Update to the fixed version for your release line, for example:composer require typo3fluid/fluid:^2.3.5

typo3fluid/fluidComposer

Affected: >=2.4.0 <2.4.1
Fixed in: 2.4.1

Update to the fixed version for your release line, for example:composer require typo3fluid/fluid:^2.4.1

typo3fluid/fluidComposer

Affected: >=2.5.0 <2.5.5
Fixed in: 2.5.5

Update to the fixed version for your release line, for example:composer require typo3fluid/fluid:^2.5.5

typo3fluid/fluidComposer

Affected: >=2.6.0 <2.6.1
Fixed in: 2.6.1

Update to the fixed version for your release line, for example:composer require typo3fluid/fluid:^2.6.1

typo3/cms-coreComposer

Affected: >=8.0.0 <8.7.25
Fixed in: 8.7.25

Update to the fixed version for your release line, for example:composer require typo3/cms-core:^8.7.25

typo3/cms-coreComposer

Affected: >=9.0.0 <9.5.6
Fixed in: 9.5.6

Update to the fixed version for your release line, for example:composer require typo3/cms-core:^9.5.6

typo3/cmsComposer

Affected: >=8.0.0 <8.7.25
Fixed in: 8.7.25

Update to the fixed version for your release line, for example:composer require typo3/cms:^8.7.25

typo3/cmsComposer

Affected: >=9.0.0 <9.5.6
Fixed in: 9.5.6

Update to the fixed version for your release line, for example:composer require typo3/cms:^9.5.6

Details

> ### Meta > * CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C(5.0) > * CWE-79

---

:information_source:  This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020

---

Problem

It has been discovered that the Fluid Engine (package typo3fluid/fluid) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.

{showFullName ? fullName : defaultValue}

Solution

Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this typo3fluid/fluid package that fix the problem described.

Updated versions of this package are bundled in following TYPO3 (typo3/cms-core) releases:

TYPO3 v8.7.25 (using typo3fluid/fluid v2.5.5)
TYPO3 v9.5.6 (using typo3fluid/fluid v2.6.1)

Credits

Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.

References

TYPO3-CORE-SA-2019-013

Is GHSA-7733-hjv6-4h47 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected typo3fluid/fluid, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.