How severe is GHSA-4mgv-366x-qxvx?

No CVSS score has been assigned to GHSA-4mgv-366x-qxvx yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-4mgv-366x-qxvx?

GHSA-4mgv-366x-qxvx affects the following packages: craftcms/cms (Packagist), craftcms/cms (Packagist). Ecosystems affected: Packagist.

How do I fix GHSA-4mgv-366x-qxvx?

Update craftcms/cms to 5.9.0-beta.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-4mgv-366x-qxvx is resolved across your whole dependency graph.

How do I detect GHSA-4mgv-366x-qxvx in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for craftcms/cms. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-4mgv-366x-qxvx if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-4mgv-366x-qxvx?

O3 pinpoints whether GHSA-4mgv-366x-qxvx is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-4mgv-366x-qxvx actively exploited in the wild?

No public exploit code has been indexed for GHSA-4mgv-366x-qxvx yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-4mgv-366x-qxvx published, and has it been updated?

GHSA-4mgv-366x-qxvx was published on March 3, 2026 and was last updated on March 4, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘 Packagist

GHSA-4mgv-366x-qxvx

Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options

Published

Mar 3, 2026

Updated

Mar 4, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Blast Radius

2 pkgs affected

🐘craftcms/cms🐘craftcms/cms

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Overview of all XSS Reports

Multiple stored XSS vulnerabilities were found in Craft CMS. They were split into 4 reports as follows:

Report	What's Vulnerable	Why Separate
This Report (1)	Multiple settings names	Twig Template: `_includes/forms/checkbox.twig`
Report 2	Entry Types Name	Twig Template: `_includes/forms/editableTable.twig`
Report 3	Card Attributes in Field Layout	`helpers/Cp.php`
Report 4 (Commerce)	Product Type Name	Source in Commerce, sink in CMS - will report this one via Commerce GHSA

Reports 2, 3, and 4 are clearly distinct locations. For this report (Report 1), it was not clear whether to split or consolidate these 7 bugs. The bug report was consolidated and the final categorization should be left to the judgement of the user.

Note: This overview is only in this Report. Other reports only reference this one.

Summary

Stored XSS in multiple settings. Names/labels are rendered without sanitization via checkbox.twig template which uses {{ label|raw }}.

Affected Sources

#	Source (injection point)	Sink (where payload reflects)
1	Section Name (`/admin/settings/sections`)	Entries field -> Sources checklist
2	Volume Name (`/admin/settings/assets/volumes/{vol_id}`)	Assets field -> Sources checklist
3	User Group Name (`/admin/settings/users/groups`)	Users field -> Sources, User permissions page
4	Global Set Name (`/admin/settings/globals`)	User permissions page
5	Generated Fields Name (Volumes, Users, etc.)	Card Attributes checkboxes
6	Checkboxes & Radio Buttons Field Option Label (`/admin/settings/fields`)	User profile pages
7	Custom Sources Label (`/admin/users` -> Customize Sources)	Users field -> Sources checklist

Proof of Concept

Required Permissions (Attacker)

Admin access
allowAdminChanges is enabled in production, which is against our security recommendations.

Bugs 1-3: Section, Volume, User Group Names

Log in as admin.
Inject payload in one of these:
- Settings -> Sections -> Create/edit section -> Name
- Settings -> Assets -> Volumes -> Create/edit volume -> Name
- Settings -> Users -> User Groups -> Create/edit group -> Name
Set Name to:

<img src=x onerror="alert('XSS')">

Save.
Go to Settings -> Fields -> Create new field.
To trigger the XSS payload: Set Field Type to "Entries" (for Sections), "Assets" (for Volumes), or "Users" (for User Groups). The alert fires when the Sources checkbox list renders.

Note: User Group Name also reflects on User permissions page under User Groups section (/admin/users/{id}/permissions).

Bug 4: Global Set Name

Go to Settings -> Globals (/admin/settings/globals).
Create/edit a Global Set, set Name to payload.
Save.
Go to Users -> Edit any user -> Permissions tab (/admin/users/{id}/permissions).
Alert fires because our payload got rendered in the "Global Sets" permissions section without encoding/sanitization.

Bug 5: Generated Fields Name

Go to Settings -> Assets -> Volumes -> Create/Edit a volume.
Scroll to Generated Fields section.
Add a field, set Name to payload:

<img src=x onerror="alert('XSS')">

Save & Notice the alert. The payload renders in the Card Attributes checkbox list below it.

Bug 6: Checkboxes/Radio Buttons Option Label

Go to Settings -> Fields (/admin/settings/fields).
Create new field, set Field Type to "Checkboxes" or "Radio Buttons".
In Field Options, add an option with Label set to payload.
Save the field.
Go to Settings -> Users -> User Profile Fields (/admin/settings/users/fields).
Add the created field to the layout and save.
Alert fires on any user profile page (/admin/users/{id}).

Bug 7: Custom Sources Label

Go to Users (/admin/users).
Click the three dots icon -> Customize Sources.
Create a new custom source, set Label to payload.
Save.
Go to Settings -> Fields -> Create new field.
Set Field Type to "Users".
Alert fires in the Sources checkbox list.

Resources

https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276 https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`craftcms/cms`	≥ 5.0.0-RC1&&< 5.9.0-beta.1	5.9.0-beta.1
🐘Packagist	`craftcms/cms`	≥ 4.0.0-RC1&&< 4.17.0-beta.1	4.17.0-beta.1

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for craftcms/cms. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update craftcms/cms to 5.9.0-beta.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-4mgv-366x-qxvx is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-4mgv-366x-qxvx is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-4mgv-366x-qxvx. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Overview of all XSS Reports Multiple stored XSS vulnerabilities were found in Craft CMS. They were split into **4 reports** as follows: | Report | What's Vulnerable | Why Separate | |--------|-------------------|--------------| | **This Report (1)** | Multiple settings names | Twig Template: `_includes/forms/checkbox.twig` | | **Report 2** | Entry Types Name | Twig Template: `_includes/forms/editableTable.twig` | | **Report 3** | Card Attributes in Field Layout | `helpers/Cp.php` | | **Report 4 (Commerce)** | Product Type Name | Source in Commerce, sink in CMS - will report this one via C

O3 Security · Impact-Aware SCA

Is GHSA-4mgv-366x-qxvx in your dependencies?

O3 detects GHSA-4mgv-366x-qxvx across Packagist dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works