GHSA-jp3q-wwp3-pwv9

Suggest an improvement
Source
https://github.com/advisories/GHSA-jp3q-wwp3-pwv9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-jp3q-wwp3-pwv9/GHSA-jp3q-wwp3-pwv9.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-jp3q-wwp3-pwv9
Aliases
Published
2026-01-22T21:41:14Z
Modified
2026-02-13T20:01:30.201062Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P CVSS Calculator
Summary
Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue
Details

Summary An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens.

Affected Product - Ecosystem: Packagist (Craft CMS plugin) - Package: solspace/craft-freeform - Version: <= 5.14.6 (latest observed). Likely all 5.x until patched.

Details - Root cause: Multiple user-controlled strings (field labels, section labels, integration icons, short names, WYSIWYG previews) are injected into React components using dangerouslySetInnerHTML without sanitization. - Evidence: dangerouslySetInnerHTML on user-controlled properties in bundled CP JS at packages/plugin/src/Resources/js/client/client.js.

PoCs - Label-based XSS: 1. In Craft CP, create/edit a Freeform field and set its label to <img src=x onerror="alert('xss-label')">. 2. Open the form builder view containing the field. 3. Alert executes (stored XSS). - Integration icon SVG: 1. Set an integration "icon SVG" to <svg><script>alert('xss-icon')</script></svg>. 2. Open the integrations CP view. 3. Script executes.

Impact Arbitrary JS in admin CP; session/CSRF token theft; potential full admin takeover via DOM-driven actions.

Remediation - Sanitize/HTML-encode all user-controlled strings before passing to dangerouslySetInnerHTML, or avoid it for labels/titles/icons. - Server-side: strip/escape disallowed tags on save for fields, integration metadata, WYSIWYG content. - Add regression tests with <img onerror> payloads to ensure no execution in builder/integration views.

Workarounds - Restrict form-edit permissions to trusted admins only until patched. - Consider CSP that disallows inline scripts (defense-in-depth only).

Credits - Discovered by https://www.linkedin.com/in/praveenkavinda/ | Prav33N-Sec.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2026-01-22T21:41:14Z",
    "nvd_published_at": "2026-02-12T23:16:09Z",
    "github_reviewed": true,
    "severity": "LOW"
}
References

Affected packages

Packagist / solspace/craft-freeform

Package

Name
solspace/craft-freeform
Purl
pkg:composer/solspace/craft-freeform

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
5.14.7

Affected versions

5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.6.1
5.0.7
5.0.8
5.0.9
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.14.1
5.0.15
5.0.16
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.5.1
5.1.6
5.1.7
5.1.8
5.1.9
5.1.10
5.1.11
5.1.12
5.1.13
5.1.13.1
5.1.14
5.1.15
5.1.16
5.1.16.1
5.1.17
5.1.18
5.1.18.1
5.1.19
5.1.19.1
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.3.3
5.3.3.1
5.3.4
5.3.5
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.5.10
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.7.0
5.7.0.1
5.7.1
5.7.2
5.7.3
5.7.4
5.8.0
5.8.1
5.8.2
5.8.3
5.8.4
5.8.5
5.8.6
5.8.7
5.9.0
5.9.1
5.9.1.1
5.9.1.2
5.9.2
5.9.3
5.9.4
5.9.5
5.9.6
5.9.7
5.9.8
5.9.9
5.9.10
5.9.11
5.9.12
5.9.13
5.9.14
5.9.15
5.9.16
5.9.16.1
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.10.10
5.10.11
5.10.12
5.10.13
5.10.14
5.10.15
5.10.15.1
5.10.16
5.10.16.1
5.10.17
5.10.17.1
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.11.5
5.11.6
5.11.7
5.11.8
5.11.9
5.11.10
5.11.11
5.11.12
5.11.13
5.11.14
5.11.16
5.11.17
5.12.0
5.12.1
5.12.2
5.12.3
5.12.4
5.13.0
5.13.1
5.13.2
5.13.3
5.13.4
5.13.5
5.13.6
5.13.7
5.13.8
5.14.0
5.14.1
5.14.2
5.14.3
5.14.4
5.14.5
5.14.6

Database specific

last_known_affected_version_range 
"<= 5.14.6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-jp3q-wwp3-pwv9/GHSA-jp3q-wwp3-pwv9.json"