{"id":"CVE-2026-56383","aliases":["GHSA-6j87-m5qx-9fqp"],"url":"https://o3.security/vulnerability/CVE-2026-56383","summary":"Craft CMS - Stored XSS in Table Field via Row Heading Column Type","details":"A stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `Row Heading` column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field.\n\n## Prerequisites\n* An administrator account\n* `allowAdminChanges` must be enabled in production, which is [against security recommendations](https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production).\n\n## Steps to Reproduce\n1. Navigate to **Settings** → **Fields** and create a new field with Type: **Table**\n1. Add a **Column Heading** and set **Column Type** to `Row Heading`\n1. In **Default Values** section, add a row with the following payload:\n    ```html\n    <img src=x onerror=\"alert('XSS')\">\n    ```\n1. Enable `Static Rows`\n1. Use the field in any object (e.g., user profile fields) → then visit any user’s profile\n1. Notice the XSS execution\n\n## Resources\n\nhttps://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a","published":"2026-06-21T13:26:59.675Z","modified":"2026-10-28T02:31:11.352539697Z","cvss":null,"epss":{"score":0.00309,"percentile":0.23781,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"4.16.19"},{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"5.8.23"}],"fix":{"url":"https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a","label":"craftcms/cms@7b372de"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56383.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-6j87-m5qx-9fqp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56383"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/craft-cms-stored-xss-in-table-field-via-row-heading-column-type"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a"},{"type":"WEB","url":"https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production"},{"type":"PACKAGE","url":"https://github.com/craftcms/cms"},{"type":"WEB","url":"https://github.com/craftcms/cms/releases/tag/4.16.19"},{"type":"WEB","url":"https://github.com/craftcms/cms/releases/tag/5.8.23"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:11.352539697Z"}}