Skip to content
OpenAdvisories

Package · npm

@sveltia/cms

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low —
    GHSA-h5jc-78hr-3pc9

    Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe

    ### Impact A stored cross-site scripting (XSS) vulnerability affected the Markdown/RichText field preview renderer in Sveltia CMS. The DOMPurify sanitization configuration used for Markdown previews explicitly permitted `iframe` elements without enforcing a `…

    @sveltia/cms npm
  • Low —
    GHSA-97r8-rf7q-wmjw

    Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML

    ### Impact A stored cross-site scripting (XSS) vulnerability affected entry summary rendering in Sveltia CMS. Entry summaries that allowed limited Markdown were parsed, sanitized, and then HTML entities were decoded. This order allowed specially crafted entit…

    @sveltia/cms npm