GHSA-9f5h-mmq6-2x78 Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields

• Packagist craftcms/cms: >= 5.0.0-RC1, < 5.8.22 → fixed in 5.8.22 • Packagist craftcms/cms: >= 4.0.0-RC1, < 4.16.18 → fixed in 4.16.18

Summary A stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the `|md|raw` Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles. Proof of Concept Required Permissions • Administrator access • `allowAdminChanges` is enabled in production, which is against our security recommendations. Steps to Reproduce 1. Log in with an admin account 2. Navigate to Settings → Fields → New field 3. Choose Number as the field type 4. Set the Prefix/Suffix Text field to: ```html ``` 5. Save the field 6. Add this field to any element (e.g., User Profile fields via Settings → Users → User Fields) 7. Navigate to your account (`/admin/myaccount`) or any user profile (`/admin/users/{id}`) 8. XSS executes when viewing the form Mitigation Sanitize prefix/suffix before rendering or use `|e` filter instead of `|raw`.