How severe is GHSA-2rp4-x2j7-qmcc?

No CVSS score has been assigned to GHSA-2rp4-x2j7-qmcc yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-2rp4-x2j7-qmcc?

GHSA-2rp4-x2j7-qmcc affects the following packages: craftcms/cms (Packagist). Ecosystems affected: Packagist.

How do I fix GHSA-2rp4-x2j7-qmcc?

Update craftcms/cms to 5.10.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-2rp4-x2j7-qmcc is resolved across your whole dependency graph.

How do I detect GHSA-2rp4-x2j7-qmcc in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for craftcms/cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-2rp4-x2j7-qmcc if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-2rp4-x2j7-qmcc?

O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-2rp4-x2j7-qmcc can be triaged on real exposure rather than presence alone.

Is GHSA-2rp4-x2j7-qmcc actively exploited in the wild?

No public exploit code has been indexed for GHSA-2rp4-x2j7-qmcc yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for GHSA-2rp4-x2j7-qmcc?

GHSA-2rp4-x2j7-qmcc has an EPSS (Exploit Prediction Scoring System) score of 0.2%, placing it in the 9th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is GHSA-2rp4-x2j7-qmcc?

GHSA-2rp4-x2j7-qmcc is classified as Cross-site Scripting (XSS) (CWE-79). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was GHSA-2rp4-x2j7-qmcc published, and has it been updated?

GHSA-2rp4-x2j7-qmcc was published on August 6, 2026 and was last updated on August 13, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘 Packagist

Not in CISA KEV

GHSA-2rp4-x2j7-qmcc — craftcms/cms

Fix: craftcms/cms@06c7991

GHSA-2rp4-x2j7-qmcc is a Cross-site Scripting (XSS) vulnerability in craftcms/cms. A fix is available for craftcms/cms — see the affected versions and patch details below.

Craft CMS: Stored XSS in the control panel via unescaped draft name

Also known asCVE-2026-72787

Published

Aug 6, 2026

Updated

Aug 13, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Sep 22, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-2rp4-x2j7-qmcc.

EPSS Exploitation Probability

via FIRST.org ↗

0.2%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs9th percentile — riskier than 9% of all scored CVEsHighest risk

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Real-World Exposure

1 pkg affected

🐘craftcms/cms

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

The control-panel helper that renders element chip/card labels writes an element's draftName into the page without HTML-encoding it, while the surrounding path segments are encoded.

A low-privilege control-panel user who can create a draft of an element (for example, an entry) controls the draft name, so they can store an XSS payload that executes in the browser of any other control-panel user who is shown that element’s chip or card (element indexes with drafts visible, relation and element-selection fields that reference the element, and the drafts list).

This allows a low-privilege author to run JavaScript in an administrator’s authenticated session and take over the control panel. It is the same output-encoding class as the recently fixed GHSA-xrqc-p465-2xvg (Structure entry title) and GHSA-3x4w-mxpf-fhqq (revision context menu), which encoded other user-controlled titles but not the draft name.

Prerequisites

A control-panel account with permission to edit entries in at least one section and create drafts.
A higher-privileged user (for example, an administrator) who is later shown the draft’s chip or card (an element index with drafts visible, or a relation/element-selection field referencing the element).

Limitations

Requires the victim to be shown the affected element's chip/card in the control panel (normal day-to-day activity; element indexes and relation fields are routine).
The payload runs in the control-panel origin in the victim’s session.

Impact

A low-privilege author can run arbitrary JavaScript in the session of any higher-privileged control-panel user who is shown the element’s chip or card, including administrators. This is a cross-privilege stored XSS, not a self-XSS: the attacker and the victim are different users, and the payload fires during routine browsing of element indexes and relation fields.

Because the script runs in the victim’s control-panel origin, it can read the CSRF token that Craft embeds in the page JavaScript (Craft.csrfTokenValue, confirmed present on control-panel pages) and issue authenticated control-panel actions as the victim. This was verified end-to-end on Craft Pro: an in-session request to the users/save-user action created a brand new account (User saved., HTTP 200), an admin-only capability that an author can never perform directly.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`craftcms/cms`	≥ 5.0.0-RC1&&< 5.10.8	5.10.8`composer require craftcms/cms:^5.10.8`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for craftcms/cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update craftcms/cms to 5.10.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-2rp4-x2j7-qmcc is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-2rp4-x2j7-qmcc can be triaged on real exposure rather than presence alone.

Tailored to GHSA-2rp4-x2j7-qmcc. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

The control-panel helper that renders element chip/card labels writes an element's `draftName` into the page without HTML-encoding it, while the surrounding path segments are encoded. A low-privilege control-panel user who can create a draft of an element (for example, an entry) controls the draft name, so they can store an XSS payload that executes in the browser of any other control-panel user who is shown that element’s chip or card (element indexes with drafts visible, relation and element-selection fields that reference the element, and the drafts list). This allows a low-privilege auth

O3 Security · Impact-Aware SCA

Is GHSA-2rp4-x2j7-qmcc in your dependencies?

O3 Security finds GHSA-2rp4-x2j7-qmcc across Packagist dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works