GHSA-6f85-3f8q-qc94
OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor
Impact
Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager
Relates to
Patch
Update GrapeJS dependency to >=v0.19.5
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor
Impact
Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager
Relates to
Patch
Update GrapeJS dependency to >=v0.19.5
- Record
GHSA-6f85-3f8q-qc94- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor
Impact
Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager
Relates to
Patch
Update GrapeJS dependency to >=v0.19.5
- Record
GHSA-6f85-3f8q-qc94- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
oro/commercePackagist | 5.0 up to 5.0.4 | 5.0.4 |
oro/commercePackagist | 5.0 up to 5.0.4, plus listed versions 5.0.05.0.0-alpha.15.0.0-alpha.25.0.0-beta.15.0.0-beta.2 Show 4 moreShow less5.0.0-rc5.0.15.0.25.0.3 | 5.0.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-6f85-3f8q-qc94 is a medium vulnerability (CVSS 6.9) in oro/commerce, published July 15, 2022. No source lists public exploit code. Fixed in oro/commerce 5.0.4.