GHSA-vrqc-59mw-qqg7

Suggest an improvement
Source
https://github.com/advisories/GHSA-vrqc-59mw-qqg7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vrqc-59mw-qqg7/GHSA-vrqc-59mw-qqg7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vrqc-59mw-qqg7
Aliases
Published
2026-03-11T14:54:00Z
Modified
2026-03-13T08:11:23Z
Severity
  • 6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
Summary
Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
Details

Description

An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered.

Impact

As property type descriptions support Markdown/HTML via the UFM rendering pipeline, injected event handlers are rendered in the backoffice interface, resulting in a stored XSS affecting other backoffice users.

Patches

The issue is patched in 16.5.1 and 17.2.2.

Workarounds

There is no workaround other than upgrading.

References

https://docs.umbraco.com/umbraco-cms/reference/umbraco-flavored-markdown

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-11T14:54:00Z",
    "nvd_published_at":  "2026-03-10T22:16:21Z",
    "severity":  "MODERATE"
}
References

Affected packages

NuGet / Umbraco.Cms

Package

Name
Umbraco.Cms
View open source insights on deps.dev
Purl
pkg:nuget/Umbraco.Cms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16.2.0
Fixed
16.5.1

Affected versions

16.*
16.2.0
16.3.0-rc
16.3.0-rc2
16.3.0-rc3
16.3.0-rc4
16.3.0
16.3.1
16.3.2
16.3.3
16.3.4
16.4.0-rc
16.4.0-rc2
16.4.0
16.4.1
16.5.0-rc
16.5.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vrqc-59mw-qqg7/GHSA-vrqc-59mw-qqg7.json"

NuGet / Umbraco.Cms

Package

Name
Umbraco.Cms
View open source insights on deps.dev
Purl
pkg:nuget/Umbraco.Cms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17.0.0
Fixed
17.2.2

Affected versions

17.*
17.0.0
17.0.1
17.0.2
17.1.0-rc
17.1.0
17.2.0-rc
17.2.0-rc2
17.2.0
17.2.1

Database specific

last_known_affected_version_range 
"< 17.2.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vrqc-59mw-qqg7/GHSA-vrqc-59mw-qqg7.json"