GHSA-9jp8-cwwx-p64q
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.
What each source reports
GitHub AdvisoriesNo score
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.
- Record
GHSA-9jp8-cwwx-p64q- Updated
- 2026-11-02
OSVNo score
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.
- Record
GHSA-9jp8-cwwx-p64q- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ezsystems/ezplatform-admin-uiPackagist | 1.5.0 to 1.5.25 | 1.5.25.1 |
ezsystems/ezplatform-admin-uiPackagist | 1.5.0 up to 1.5.25.1, plus listed versions v1.5.0v1.5.1v1.5.10v1.5.11v1.5.12 Show 23 moreShow lessv1.5.13v1.5.14v1.5.15v1.5.16v1.5.17v1.5.18v1.5.19v1.5.2v1.5.20v1.5.21v1.5.22v1.5.23v1.5.24v1.5.25v1.5.3v1.5.4v1.5.5v1.5.6v1.5.7v1.5.8v1.5.8-rc1v1.5.9v1.5.9-rc1 | 1.5.25.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-9jp8-cwwx-p64q is a vulnerability with no CVSS score yet in ezsystems/ezplatform-admin-ui, published December 1, 2021. No source lists public exploit code. Fixed in ezsystems/ezplatform-admin-ui 1.5.25.1.