MediumGHSA-9cx2-hj6m-fv58CVE-2022-38724
Silverstripe XSS in shortcodes
Published 21 Nov 2022 · Updated 29 Apr 2025
Affected packages
silverstripe/assetsComposer
- Affected
- >=1.0.0 <1.11.1
- Fixed in
- 1.11.1
Update to the fixed version for your release line, for example:
composer require silverstripe/assets:^1.11.1silverstripe/frameworkComposer
- Affected
- >=4.0.0 <4.11.13
- Fixed in
- 4.11.13
Update to the fixed version for your release line, for example:
composer require silverstripe/framework:^4.11.13Details
A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used to inject a JavaScript payload on the front end of the site. The shortcode providers that ship with Silverstripe CMS have been reviewed and attribute whitelists have been implemented where appropriate to negate this risk.
Is GHSA-9cx2-hj6m-fv58 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected silverstripe/assets, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2022-38724
- Linkforum.silverstripe.org/c/releases
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2022-38724.yaml
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-38724.yaml
- Linkwww.silverstripe.org/blog/tag/release
- Linkwww.silverstripe.org/download/security-releases
- Linkwww.silverstripe.org/download/security-releases/cve-2022-38724
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.