CraftCMS CraftSupport DOM XSS via GitHub Issue Title (CVE-2026-55790)

Vulnerability Overview Vulnerability Name: DOM XSS via GitHub issue title in CraftSupport widget Vulnerability Type: DOM XSS Severity: High CVE ID: CVE-2026-55790 CWE: CWE-79 Affected Scope Affected Versions: - >= 5.0.0RC1, = 4.0.0RC1, < 4.17.15 Remediation Fixed Versions: - 5.9.23 - 4.17.16 Description Summary: - An attacker with a GitHub account can implant a JavaScript payload in the title of an issue on . When a Craft administrator uses the "Give feedback" screen of the CraftSupport widget and enters a search term that returns the tainted issue, the payload executes within the administrator's Control Panel session. - No administrator account or privilege escalation is required. Prerequisites: - The attacker has a GitHub account (no Control Panel access required). - The victim is an administrator who has the CraftSupport widget on their dashboard. - The victim uses the "Give feedback" screen and enters a search term that returns the tainted issue. Root Cause: - A vulnerability exists in the code, specifically in the method, which directly returns the from the GitHub API response. The jQuery method then immediately executes HTML containing . Reproduction Steps 1. Attacker (GitHub Account): - Open - Set the title to a string containing a plausible search term and a payload, e.g., - Submit the issue 2. Victim (Craft Administrator): - Open the Craft Control Panel dashboard - Open the CraftSupport widget and click "Give feedback" - Enter in the search box - triggers within the administrator's session Impact XSS executes within the administrator's Control Panel session. The payload can access and , allowing cross-site requests to be sent as the administrator without further interaction. Mitigating Factors The victim must actively use the "Give feedback" search screen. The attacker must predict or use social engineering to influence the search term entered by the administrator, or use a broad term that might match. The widget is only available to administrators. References Stack Overflow POC Code

Goal Reached Thanks to every supporter — we hit 100%!

CraftCMS CraftSupport DOM XSS via GitHub Issue Title (CVE-2026-55790)

More from this source