Skip to content
OpenAdvisories

Package · Packagist

j0k3r/graby

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low —
    GHSA-3h6j-9x8m-rg3g

    Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

    ## Summary Graby's `cleanupXss()` function configures htmLawed with conflicting settings: `safe=1` (which removes `<iframe>`) combined with `'elements' => '*+iframe-meta'` (which re-enables `<iframe>`). htmLawed does not sanitize the `srcdoc` attribute, allow…

    j0k3r/graby Packagist