GHSA-w7rq-fgx4-4xcm

Source

https://github.com/advisories/GHSA-w7rq-fgx4-4xcm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-w7rq-fgx4-4xcm/GHSA-w7rq-fgx4-4xcm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w7rq-fgx4-4xcm

Aliases

CVE-2025-71177

Published

2026-01-23T18:31:30Z

Modified

2026-02-03T03:08:31Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

LavaLite CMS affected by a stored cross-site scripting vulnerability

Details

LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later rendered without proper output encoding in package search results. When other users view search results that include the malicious package, the injected script executes in their browsers, potentially enabling session hijacking, credential theft, and unauthorized actions in the context of the victim.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-01-23T20:16:37Z",
    "nvd_published_at":  "2026-01-23T17:16:08Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / lavalite/cms

Package

Name: lavalite/cms
Purl: pkg:composer/lavalite/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

10.1.0

Affected versions

v5.*

v5.0.0

v5.1.0

v5.1.1

v5.2.0

v5.2.1

v5.2.2

v5.2.3

v5.2.4

v5.3.0

v5.3.1

v5.3.2

v5.3.3

v5.3.4

v5.3.5

v5.3.6

v5.3.7

v5.4.0

v5.4.1

v5.4.2

v5.4.3

v5.4.4

v5.4.5

v5.8.0

5.*

5.5.0

5.5.1

5.5.2

5.5.3

5.5.4

5.5.5

5.5.6

5.5.7

5.5.8

5.5.9

5.6.1

5.6.2

5.7.0

5.7.1

5.7.2

5.7.3

5.7.4

v7.*

v7.0.1

v8.*

v8.0.0

v8.0.1

v8.1.0

v8.1.1

v8.1.2

v9.*

v9.0.0

v10.*

v10.0.0

v10.0.1

v10.0.2

v10.0.3

v10.0.4

v10.0.5

v10.0.6

v10.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-w7rq-fgx4-4xcm/GHSA-w7rq-fgx4-4xcm.json"