GHSA-3432-fmrf-7vmh

Suggest an improvement
Source
https://github.com/advisories/GHSA-3432-fmrf-7vmh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-3432-fmrf-7vmh/GHSA-3432-fmrf-7vmh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3432-fmrf-7vmh
Aliases
Published
2025-05-28T16:06:03Z
Modified
2025-05-30T21:58:08.274650Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Chrome PHP is missing encoding in `CssSelector`
Details

Impact

CSS Selector expressions are not properly encoded, which can lead to XSS (cross-site scripting) vulnerabilities.

Patches

This is patched in v1.14.0.

Workarounds

Users can apply encoding manually to their selectors, if they are unable to upgrade.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed_at": "2025-05-28T16:06:03Z",
    "github_reviewed": true,
    "nvd_published_at": "2025-05-30T19:15:29Z"
}
References

Affected packages

Packagist / chrome-php/chrome

Package

Name
chrome-php/chrome
Purl
pkg:composer/chrome-php/chrome

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.14.0

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.3.0
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.9.0
v0.10.0
v0.11.0
v0.11.1
v0.11.2
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.8.1
v1.9.0
v1.9.1
v1.10.0
v1.10.1
v1.11.0
v1.12.0
v1.12.1
v1.13.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-3432-fmrf-7vmh/GHSA-3432-fmrf-7vmh.json"