MediumGHSA-h9vc-2p9g-63gpCVE-2022-0565

Cross-site Scripting in pimcore

Published 15 Feb 2022 · Updated 28 Feb 2026

Affected package

pimcore/pimcoreComposer

Affected: <10.3.1
Fixed in: 10.3.1

Update to the fixed version for your release line, for example:composer require pimcore/pimcore:^10.3.1

Details

Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1.

Is GHSA-h9vc-2p9g-63gp in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/pimcore, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2022-0565
Linkgithub.com/pimcore/pimcore/commit/7697f709a501860144352696e583a2533a6e1245
Linkgithub.com/pimcore/pimcore
Linkhuntr.dev/bounties/b0b29656-4bbe-41cf-92f6-8579df0b6de5

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.