GitHub Advisoryadvisory · Packagist

GHSA-65fp-7g2v-658r Bagisto affected by Cross-site Scripting

LOW Published 2026-04-21 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-6745
Ecosystem
Packagist
Packages
bagisto/bagisto
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-05-06

Affected packages

• Packagist bagisto/bagisto: <= 2.3.15 (no fix yet)

Description

A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom Scripts Handler. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and explained: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."

Related

Alias · CVE (1)

  • CVE-2026-6745 A vulnerability was determined in Bagisto up to 2.3.15. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References