GitHub Advisoryadvisory · Packagist

GHSA-424m-fj2q-g7vg Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors

HIGH Published 2025-12-03 Modified 2025-12-03 Official page ↗
Aliases
CVE-2025-66468
Ecosystem
Packagist
Packages
aimeos/ai-cms-grapesjs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2025-12-03

Affected packages

• Packagist aimeos/ai-cms-grapesjs: >= 2021.04.1, < 2021.10.8 → fixed in 2021.10.8 • Packagist aimeos/ai-cms-grapesjs: >= 2022.04.1, < 2022.10.9 → fixed in 2022.10.9 • Packagist aimeos/ai-cms-grapesjs: >= 2023.04.1, < 2023.10.15 → fixed in 2023.10.15 • Packagist aimeos/ai-cms-grapesjs: >= 2024.04.1, < 2024.10.8 → fixed in 2024.10.8 • Packagist aimeos/ai-cms-grapesjs: >= 2025.04.1, < 2025.10.2 → fixed in 2025.10.2

Description

Impact Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. Workaround If the standard CSP rules are active (default in production mode), an exploit isn't possible. Credits Lwin Min Oo

Related

Alias · CVE (1)

  • CVE-2025-66468 The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References