GHSA-97jm-g33h-f46g is a medium-severity (CVSS 6.1) vulnerability in silverstripe/framework. A fix is available for silverstripe/framework — see the affected versions and patch details below.
silverstripe/framework ReadOnly transformation for formfields exploitable
Real-World Exposure
silverstripe/framework🐘silverstripe/framework🐘silverstripe/framework🐘silverstripe/frameworkReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Form fields returning isReadonly() as true are vulnerable to reflected XSS injections. This includes ReadonlyField, LookupField, HTMLReadonlyField, as well as special purpose fields like TimeField_Readonly. Values submitted to through these form fields are not filtered out from the form session data, and might be shown to the user depending on the form behaviour. For example, form validation errors cause the form to re-render with previously submitted values by default.
SilverStripe forms automatically load values from request data (GET and POST), which enables malicious use of URLs if your form uses these fields and doesn't overwrite data on form construction.
Readonly and disabled form fields are already filtered out in Form->saveInto(), so maliciously submitted data on these fields doesn't make it into the database unless you are accessing form values directly in your saving logic.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | silverstripe/framework | all versions | 3.1.21composer require silverstripe/framework:^3.1.21 |
| 🐘Packagist | silverstripe/framework | ≥ 3.2.0&&< 3.2.6 | 3.2.6composer require silverstripe/framework:^3.2.6 |
| 🐘Packagist | silverstripe/framework | ≥ 3.3.0&&< 3.3.4 | 3.3.4composer require silverstripe/framework:^3.3.4 |
| 🐘Packagist | silverstripe/framework | ≥ 3.4.0&&< 3.4.2 | 3.4.2composer require silverstripe/framework:^3.4.2 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for silverstripe/framework, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update silverstripe/framework to 3.1.21 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-97jm-g33h-f46g is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-97jm-g33h-f46g can be triaged on real exposure rather than presence alone.
Tailored to GHSA-97jm-g33h-f46g. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-97jm-g33h-f46g in your dependencies?
O3 Security finds GHSA-97jm-g33h-f46g across Packagist dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.