GHSA-vrqc-59mw-qqg7 Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

• NuGet Umbraco.Cms: >= 16.2.0, < 16.5.1 → fixed in 16.5.1 • NuGet Umbraco.Cms: >= 17.0.0, < 17.2.2 → fixed in 17.2.2

Description An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive `attributeNameCheck` configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (`umb-*`, `uui-*`, `ufm-*`) were not filtered. Impact As property type descriptions support Markdown/HTML via the UFM rendering pipeline, injected event handlers are rendered in the backoffice interface, resulting in a stored XSS affecting other backoffice users. Patches The issue is patched in 16.5.1 and 17.2.2. Workarounds There is no workaround other than upgrading. References https://docs.umbraco.com/umbraco-cms/reference/umbraco-flavored-markdown