{"id":"CVE-2024-35621","aliases":["EUVD-2024-1635","GHSA-gx8m-f3mp-fg99"],"status":"published","title":"formwork Cross-site scripting vulnerability in Markdown fields","description":"A cross-site scripting (XSS) vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00271,"percentile":0.19555,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-05-28T15:40:26Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Packagist","package":"getformwork/formwork","fixed_in":["1.13.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"getformwork/formwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"getformwork/formwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.11.0","0.11.1","0.11.2","0.12.0","0.12.1","0.6.10","0.6.11","0.6.12","0.6.9","0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","1.0.0","1.1.0","1.1.1","1.10.0","1.10.1","1.10.2","1.10.3","1.11.0","1.11.1","1.12.0","1.12.1","1.2.0","1.2.1","1.3.0","1.3.1","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.7.0","1.7.1","1.8.0","1.9.0","1.9.1"]}],"references":[{"url":"https://github.com/getformwork/formwork/security/advisories/GHSA-gx8m-f3mp-fg99","tags":["x_transferred","advisory","web"]},{"url":"https://github.com/getformwork/formwork/commit/2d92e6dbf99a9a49797947afbda0cdd4e56e11df","tags":["web"]},{"url":"https://github.com/getformwork/formwork/commit/6adc302f5a294f2ffbbf1571dd4ffea6b7876723","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35621","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gx8m-f3mp-fg99"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35621.json","tags":["advisory"]},{"url":"https://github.com/getformwork/formwork","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-35621","description":"A cross-site scripting (XSS) vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field.","status":"published","published":"2024-05-28T15:40:26.625Z","modified":"2025-03-28T19:29:27.818Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:20.313092Z"}],"euvd":[{"id":"EUVD-2024-1635","description":"A cross-site scripting (XSS) vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field.","status":"published","published":"2024-05-28T15:40:26Z","modified":"2025-03-28T19:29:27Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:47.247959Z"}],"ghsa":[{"id":"GHSA-gx8m-f3mp-fg99","title":"formwork Cross-site scripting vulnerability in Markdown fields","description":"### Impact\nUsers with access to the administration panel with page editing permissions could insert `\u003cscript\u003e` tags in markdown fields, which are exposed on the publicly accessible site pages, leading to potential XSS injections.\n\n### Patches\n\n- [**Formwork 1.13.0**](https://github.com/getformwork/formwork/releases/tag/1.13.0) has been released with a patch that solves this vulnerability. Now the system config option `content.safe_mode` (enabled by default) controls whether HTML tags and potentially dangerous links are escaped. This is configurable as in some cases more flexibility should be given. Panel users should be only a controlled group of editors, which cannot enable the option by themselves, and not a generic group. This mitigates the chance of introducing vulnerabilities.\n- [**Formwork 2.x** (6adc302)](https://github.com/getformwork/formwork/commit/6adc302f5a294f2ffbbf1571dd4ffea6b7876723) adds a similar `content.safeMode` system option. Like Formwork 1.13.0, by default HTML tags and dangerous link are escaped. Even if enabled by an administrator, however, `\u003cscript\u003e` and other dangerous tags are still converted to text, but secure tags are allowed.\n\n### References\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35621\n","status":"published","published":"2024-05-28T16:54:31Z","modified":"2024-06-10T17:30:09Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:54.624184Z"}],"nvd":[{"id":"CVE-2024-35621","description":"A cross-site scripting (XSS) vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field.","status":"published","published":"2024-05-28T16:15:16.96Z","modified":"2026-06-17T07:35:04.847Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:02.520903Z"}],"osv":[{"id":"CVE-2024-35621","description":"A cross-site scripting (XSS) vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field.","status":"published","published":"2024-05-28T15:40:26.625Z","modified":"2026-10-28T02:31:00.020559765Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"GHSA-gx8m-f3mp-fg99","title":"formwork Cross-site scripting vulnerability in Markdown fields","description":"### Impact\nUsers with access to the administration panel with page editing permissions could insert `\u003cscript\u003e` tags in markdown fields, which are exposed on the publicly accessible site pages, leading to potential XSS injections.\n\n### Patches\n\n- [**Formwork 1.13.0**](https://github.com/getformwork/formwork/releases/tag/1.13.0) has been released with a patch that solves this vulnerability. Now the system config option `content.safe_mode` (enabled by default) controls whether HTML tags and potentially dangerous links are escaped. This is configurable as in some cases more flexibility should be given. Panel users should be only a controlled group of editors, which cannot enable the option by themselves, and not a generic group. This mitigates the chance of introducing vulnerabilities.\n- [**Formwork 2.x** (6adc302)](https://github.com/getformwork/formwork/commit/6adc302f5a294f2ffbbf1571dd4ffea6b7876723) adds a similar `content.safeMode` system option. Like Formwork 1.13.0, by default HTML tags and dangerous link are escaped. Even if enabled by an administrator, however, `\u003cscript\u003e` and other dangerous tags are still converted to text, but secure tags are allowed.\n\n### References\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35621\n","status":"published","published":"2024-05-28T16:54:31Z","modified":"2026-07-08T06:53:06.086285941Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"}]}}