{"id":"GHSA-vf6x-59hh-332f","aliases":[],"status":"published","title":"Formwork has a cross-site scripting (XSS) vulnerability in Site title","description":"### Summary\n\nThe site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.\n\n### Impact\n\nThe attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.\n\n### Patches\n- [**Formwork 2.x** (aa3e9c6)](https://github.com/getformwork/formwork/commit/aa3e9c684035d9e8495169fde7c57d97faa3f9a2) escapes site title from panel header navigation.\n\n### Details\n\nBy embedding \"\u003c!--\", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-80"],"published":"2025-03-01T00:11:46Z","modified":"2026-02-18T23:55:33Z","fixes":[{"ecosystem":"Packagist","package":"getformwork/formwork","fixed_in":["2.0.0-beta.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"getformwork/formwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta.3"},{"last_affected":"2.0.0-beta.3"},{"fixed":"2.0.0-beta.4"}]}],"versions":["2.0.0-beta.3"]},{"source":"osv","ecosystem":"Packagist","package":"getformwork/formwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta.3"},{"fixed":"2.0.0-beta.4"}]}],"versions":["2.0.0-beta.3"]}],"references":[{"url":"https://github.com/getformwork/formwork/security/advisories/GHSA-vf6x-59hh-332f","tags":["web"]},{"url":"https://github.com/getformwork/formwork/commit/aa3e9c684035d9e8495169fde7c57d97faa3f9a2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vf6x-59hh-332f"},{"url":"https://github.com/getformwork/formwork","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-vf6x-59hh-332f","title":" Formwork has a cross-site scripting (XSS) vulnerability in Site title","description":"### Summary\n\nThe site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.\n\n### Impact\n\nThe attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.\n\n### Patches\n- [**Formwork 2.x** (aa3e9c6)](https://github.com/getformwork/formwork/commit/aa3e9c684035d9e8495169fde7c57d97faa3f9a2) escapes site title from panel header navigation.\n\n### Details\n\nBy embedding \"\u003c!--\", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.","status":"published","published":"2025-03-01T00:11:46Z","modified":"2026-02-18T23:47:23Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:39:25.82905Z"}],"osv":[{"id":"GHSA-vf6x-59hh-332f","title":" Formwork has a cross-site scripting (XSS) vulnerability in Site title","description":"### Summary\n\nThe site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.\n\n### Impact\n\nThe attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.\n\n### Patches\n- [**Formwork 2.x** (aa3e9c6)](https://github.com/getformwork/formwork/commit/aa3e9c684035d9e8495169fde7c57d97faa3f9a2) escapes site title from panel header navigation.\n\n### Details\n\nBy embedding \"\u003c!--\", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.","status":"published","published":"2025-03-01T00:11:46Z","modified":"2026-02-18T23:55:33.002649Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T15:46:56.981655Z"}]}}