CVE-2026-92590

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-92590

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92590.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-92590

Aliases

GHSA-h9jh-v8vc-m5rp

Published

2026-09-16T21:46:56Z

Modified

2026-09-20T11:30:18Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields

Details

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticated Control Panel sessions of higher-privileged users viewing element indexes.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92590.json"
}

References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type

GIT

Repo

https://github.com/craftcms/cms

Events

Introduced

45b4a1a56a82ad85d8d3442fcf914f35cd62e73b

Fixed

0b18123e8c3be1edcf6f785e9925e1b1007ce8c5

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "5.7.0"
        },
        {
            "fixed":  "5.10.13"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

5.*

5.10.0

5.10.1

5.10.10

5.10.11

5.10.12

5.10.2

5.10.3

5.10.4

5.10.4.1

5.10.5

5.10.6

5.10.7

5.10.8

5.10.8.1

5.10.9

5.7.0

5.7.1

5.7.1.1

5.7.10

5.7.11

5.7.2

5.7.3

5.7.4

5.7.5

5.7.6

5.7.7

5.7.8

5.7.8.1

5.7.8.2

5.7.9

5.8.0

5.8.1

5.8.10

5.8.11

5.8.12

5.8.13

5.8.13.1

5.8.13.2

5.8.14

5.8.15

5.8.16

5.8.17

5.8.18

5.8.19

5.8.2

5.8.20

5.8.21

5.8.22

5.8.23

5.8.3

5.8.4

5.8.5

5.8.6

5.8.7

5.8.8

5.8.9

5.9.0

5.9.0-beta.1

5.9.0-beta.2

5.9.1

5.9.10

5.9.11

5.9.12

5.9.13

5.9.14

5.9.15

5.9.16

5.9.17

5.9.18

5.9.19

5.9.2

5.9.20

5.9.21

5.9.22

5.9.23

5.9.3

5.9.4

5.9.5

5.9.6

5.9.7

5.9.8

5.9.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92590.json"