Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐘 Packagist
Not in CISA KEV

XSS vulnerability when listing users on add & modify server pagesGHSA-5822-pw57-vv37

GHSA-5822-pw57-vv37 is a security vulnerability in pterodactyl/panel. A fix is available for pterodactyl/panel — see the affected versions and patch details below.

Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Dec 2, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected
🐘pterodactyl/panel🐘pterodactyl/panel

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact

An XSS vulnerability exists in versions of Pterodactyl Panel before 0.7.19. Affected versions do not properly sanitize account names before rendering them to the dropdown selector in the admin area when creating or modifying a server.

Patches

This XSS has been addressed in 0.7.19 and will be rolled forwards into the 1.0-rc.7 release.

Workarounds

No workaround exists without manual patching. See https://github.com/pterodactyl/panel/pull/2441/files for the files changed.

For more information

If you have any questions or comments about this advisory please reach out on Discord, or by emailing dane at pterodactyl dot io.

Thank you to Sergej for the responsible disclosure of this issue.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistpterodactyl/panelall versions0.7.19composer require pterodactyl/panel:^0.7.19
🐘Packagistpterodactyl/panel≥ 1.0.0-rc.0&&< 1.0.0-rc.71.0.0-rc.7composer require pterodactyl/panel:^1.0.0-rc.7

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for pterodactyl/panel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update pterodactyl/panel to 0.7.19 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5822-pw57-vv37 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Impact An XSS vulnerability exists in versions of Pterodactyl Panel before 0.7.19. Affected versions do not properly sanitize account names before rendering them to the dropdown selector in the admin area when creating or modifying a server. ### Patches This XSS has been addressed in 0.7.19 and will be rolled forwards into the 1.0-rc.7 release. ### Workarounds No workaround exists without manual patching. See https://github.com/pterodactyl/panel/pull/2441/files for the files changed. ### For more information If you have any questions or comments about this advisory please reach out on D
O3 Security · Impact-Aware SCA

Is GHSA-5822-pw57-vv37 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
XSS vulnerability when listing users on add & modify…