Description
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | silverstripe/framework | >= 4.0.0, < 4.11.13 | 4.11.13 | GHSA-wc6r-4ggc-79w5 |