GHSA-jp3q-wwp3-pwv9

Source

https://github.com/advisories/GHSA-jp3q-wwp3-pwv9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-jp3q-wwp3-pwv9/GHSA-jp3q-wwp3-pwv9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jp3q-wwp3-pwv9

Aliases

CVE-2026-26188

Published

2026-01-22T21:41:14Z

Modified

2026-02-13T16:46:57Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P CVSS Calculator

Summary

Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue

Details

Summary An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens.

Affected Product

Ecosystem: Packagist (Craft CMS plugin)
Package: solspace/craft-freeform
Version: <= 5.14.6 (latest observed). Likely all 5.x until patched.

Details

Root cause: Multiple user-controlled strings (field labels, section labels, integration icons, short names, WYSIWYG previews) are injected into React components using dangerouslySetInnerHTML without sanitization.
Evidence: dangerouslySetInnerHTML on user-controlled properties in bundled CP JS at packages/plugin/src/Resources/js/client/client.js.

PoCs

Label-based XSS:
1. In Craft CP, create/edit a Freeform field and set its label to <img src=x onerror="alert('xss-label')">.
2. Open the form builder view containing the field.
3. Alert executes (stored XSS).
Integration icon SVG:
1. Set an integration "icon SVG" to <svg><script>alert('xss-icon')</script></svg>.
2. Open the integrations CP view.
3. Script executes.

Impact Arbitrary JS in admin CP; session/CSRF token theft; potential full admin takeover via DOM-driven actions.

Remediation

Sanitize/HTML-encode all user-controlled strings before passing to dangerouslySetInnerHTML, or avoid it for labels/titles/icons.
Server-side: strip/escape disallowed tags on save for fields, integration metadata, WYSIWYG content.
Add regression tests with <img onerror> payloads to ensure no execution in builder/integration views.

Workarounds

Restrict form-edit permissions to trusted admins only until patched.
Consider CSP that disallows inline scripts (defense-in-depth only).

Credits

Discovered by https://www.linkedin.com/in/praveenkavinda/ | Prav33N-Sec.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-01-22T21:41:14Z",
    "nvd_published_at":  "2026-02-12T23:16:09Z",
    "severity":  "LOW"
}

References

Affected packages

Packagist / solspace/craft-freeform

Package

Name: solspace/craft-freeform
Purl: pkg:composer/solspace/craft-freeform

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.14.7

Affected versions

5.*

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.0.6.1

5.0.7

5.0.8

5.0.9

5.0.10

5.0.11

5.0.12

5.0.13

5.0.14

5.0.14.1

5.0.15

5.0.16

5.1.0

5.1.1

5.1.2

5.1.3

5.1.4

5.1.5

5.1.5.1

5.1.6

5.1.7

5.1.8

5.1.9

5.1.10

5.1.11

5.1.12

5.1.13

5.1.13.1

5.1.14

5.1.15

5.1.16

5.1.16.1

5.1.17

5.1.18

5.1.18.1

5.1.19

5.1.19.1

5.2.0

5.2.1

5.2.2

5.3.0

5.3.1

5.3.2

5.3.3

5.3.3.1

5.3.4

5.3.5

5.4.0

5.4.1

5.4.2

5.5.0

5.5.1

5.5.2

5.5.3

5.5.4

5.5.5

5.5.6

5.5.7

5.5.8

5.5.9

5.5.10

5.6.0

5.6.1

5.6.2

5.6.3

5.6.4

5.6.5

5.6.6

5.6.7

5.6.8

5.7.0

5.7.0.1

5.7.1

5.7.2

5.7.3

5.7.4

5.8.0

5.8.1

5.8.2

5.8.3

5.8.4

5.8.5

5.8.6

5.8.7

5.9.0

5.9.1

5.9.1.1

5.9.1.2

5.9.2

5.9.3

5.9.4

5.9.5

5.9.6

5.9.7

5.9.8

5.9.9

5.9.10

5.9.11

5.9.12

5.9.13

5.9.14

5.9.15

5.9.16

5.9.16.1

5.10.0

5.10.1

5.10.2

5.10.3

5.10.4

5.10.5

5.10.6

5.10.7

5.10.8

5.10.9

5.10.10

5.10.11

5.10.12

5.10.13

5.10.14

5.10.15

5.10.15.1

5.10.16

5.10.16.1

5.10.17

5.10.17.1

5.11.0

5.11.1

5.11.2

5.11.3

5.11.4

5.11.5

5.11.6

5.11.7

5.11.8

5.11.9

5.11.10

5.11.11

5.11.12

5.11.13

5.11.14

5.11.16

5.11.17

5.12.0

5.12.1

5.12.2

5.12.3

5.12.4

5.13.0

5.13.1

5.13.2

5.13.3

5.13.4

5.13.5

5.13.6

5.13.7

5.13.8

5.14.0

5.14.1

5.14.2

5.14.3

5.14.4

5.14.5

5.14.6

Database specific

last_known_affected_version_range

"<= 5.14.6"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-jp3q-wwp3-pwv9/GHSA-jp3q-wwp3-pwv9.json"