GHSA-jfxf-4frr-9j3q
XSS in various backend modules due to (un)escaping in JS notification module
The notification module displaying flash messages unscapes HTML coming from the server, resulting in XSS vulnerabilities with various names and labels of entities (eg. workspace title or media title). This however means you must be a logged in user with respective rights in the first place to leverage the attack vector.
What each source reports
GitHub AdvisoriesNo score
XSS in various backend modules due to (un)escaping in JS notification module
The notification module displaying flash messages unscapes HTML coming from the server, resulting in XSS vulnerabilities with various names and labels of entities (eg. workspace title or media title). This however means you must be a logged in user with respective rights in the first place to leverage the attack vector.
- Record
GHSA-jfxf-4frr-9j3q- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
XSS in various backend modules due to (un)escaping in JS notification module
The notification module displaying flash messages unscapes HTML coming from the server, resulting in XSS vulnerabilities with various names and labels of entities (eg. workspace title or media title). This however means you must be a logged in user with respective rights in the first place to leverage the attack vector.
- Record
GHSA-jfxf-4frr-9j3q- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
neos/neosPackagist | 3.3 up to 5.3.10 | 5.3.10 |
neos/neosPackagist | 7.0.0 up to 7.0.9 | 7.0.9 |
neos/neosPackagist | 7.1.0 up to 7.1.7 | 7.1.7 |
neos/neosPackagist | 7.2.0 up to 7.2.6 | 7.2.6 |
neos/neosPackagist | 7.3.0 up to 7.3.4 | 7.3.4 |
neos/neosPackagist | 8.0.0 up to 8.0.2 | 8.0.2 |
neos/neosPackagist | 3.3 up to 5.3.10, plus listed versions 3.3.03.3.13.3.103.3.113.3.12 Show 45 moreShow less3.3.133.3.143.3.153.3.163.3.173.3.183.3.193.3.23.3.203.3.213.3.223.3.233.3.243.3.253.3.263.3.273.3.283.3.293.3.33.3.43.3.53.3.63.3.73.3.83.3.94.0.04.0.14.0.104.0.114.0.124.0.134.0.144.0.154.0.164.0.174.0.184.0.194.0.24.0.204.0.214.0.224.0.234.0.34.0.44.0.5 | 5.3.10 |
neos/neosPackagist | 7.0.0 up to 7.0.9, plus listed versions 7.0.17.0.27.0.37.0.47.0.57.0.67.0.77.0.8 | 7.0.9 |
neos/neosPackagist | 7.1.0 up to 7.1.7, plus listed versions 7.1.17.1.27.1.37.1.47.1.57.1.6 | 7.1.7 |
neos/neosPackagist | 7.2.0 up to 7.2.6, plus listed versions 7.2.17.2.27.2.37.2.47.2.5 | 7.2.6 |
neos/neosPackagist | 7.3.0 up to 7.3.4, plus listed versions 7.3.17.3.27.3.3 | 7.3.4 |
neos/neosPackagist | 8.0.0 up to 8.0.2, plus listed versions 8.0.1 | 8.0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-jfxf-4frr-9j3q is a vulnerability with no CVSS score yet in neos/neos, published May 25, 2022. No source lists public exploit code. Fixed in neos/neos 5.3.10.
References
Left out here: 115 versions. The JSON record has them.