CVE-2026-56383

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56383
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56383.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56383
Aliases
Published
2026-06-21T13:26:59.675Z
Modified
2026-07-08T08:13:46.985107247Z
Severity
  • 4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Craft CMS - Stored XSS in Table Field via Row Heading Column Type
Details

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56383.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
64715042874709bd8e0f3ec7f7353846f7a545bd
Fixed
1a8db788c8b3de85c3aed09ac34046e230079481
Introduced
04755d93f86d07cc183db47db8a0eee106892e30
Fixed
daf0ed01c7d2c194ba4a405290e43934d020eef2
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "4.5.0-beta.1"
        },
        {
            "fixed": "4.16.19"
        },
        {
            "introduced": "5.0.0-RC1"
        },
        {
            "fixed": "5.8.23"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56383.json"