GHSA-4gpr-p634-922x Cross site scripting via input unit widget

• Packagist contao/core-bundle: >= 4.0.0, < 4.9.42 → fixed in 4.9.42 • Packagist contao/core-bundle: >= 4.10.0, < 4.13.28 → fixed in 4.13.28 • Packagist contao/core-bundle: >= 5.0.0, < 5.1.10 → fixed in 5.1.10

Impact Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview (back end) and on the website (front end). Patches Update to Contao 4.9.42, 4.13.28 or 5.1.10. Workarounds Disable login for all untrusted back end users. References https://contao.org/en/security-advisories/cross-site-scripting-in-widgets-with-units For more information If you have any questions or comments about this advisory, open an issue in contao/contao. Credits Thanks to Christian Pöschl and Fabian Brenner from usd AG for reporting this vulnerability.