p PatchFirst

GHSA-6f85-3f8q-qc94

GHSA-6f85-3f8q-qc94 · OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor

This page contains facts from public vulnerability sources. Check the original advisory before updating.

# Impact Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager # Relates to - [https://github.com/artf/grapesjs/issues/4411](https://github.com/artf/grapesjs/issues/4411) # Patch Update GrapeJS dependency to >=[v0.19.5](https://github.com/artf/grapesjs/releases/tag/v0.19.5)

CVSS 6.9 · Medium · Fix available

Published
Updated

Stack: php

Affected products and versions

  • oro/commerce Packagist

    Versions
    • 5.0.0
    • 5.0.0-alpha.1
    • 5.0.0-alpha.2
    • 5.0.0-beta.1
    • 5.0.0-beta.2
    • 5.0.0-rc
    • 5.0.1
    • 5.0.2
    • 5.0.3
    Affected ranges
    • ECOSYSTEM: ≥ 5.0, < 5.0.4

    Update to 5.0.4

Original sources

Check your server →