silverstripe/framework ReadOnly transformation for formfields exploitableGHSA-97jm-g33h-f46g
MEDIUMFix: silverstripe/silverstripe-framework@8336cb9GHSA-97jm-g33h-f46g is a medium-severity (CVSS 6.1) vulnerability in silverstripe/framework. A fix is available for silverstripe/framework — see the affected versions and patch details below.
Real-World Exposure
silverstripe/framework🐘silverstripe/framework🐘silverstripe/framework🐘silverstripe/frameworkReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Form fields returning isReadonly() as true are vulnerable to reflected XSS injections. This includes ReadonlyField, LookupField, HTMLReadonlyField, as well as special purpose fields like TimeField_Readonly. Values submitted to through these form fields are not filtered out from the form session data, and might be shown to the user depending on the form behaviour. For example, form validation errors cause the form to re-render with previously submitted values by default.
SilverStripe forms automatically load values from request data (GET and POST), which enables malicious use of URLs if your form uses these fields and doesn't overwrite data on form construction.
Readonly and disabled form fields are already filtered out in Form->saveInto(), so maliciously submitted data on these fields doesn't make it into the database unless you are accessing form values directly in your saving logic.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | silverstripe/framework | all versions | 3.1.21composer require silverstripe/framework:^3.1.21 |
| 🐘Packagist | silverstripe/framework | ≥ 3.2.0&&< 3.2.6 | 3.2.6composer require silverstripe/framework:^3.2.6 |
| 🐘Packagist | silverstripe/framework | ≥ 3.3.0&&< 3.3.4 | 3.3.4composer require silverstripe/framework:^3.3.4 |
| 🐘Packagist | silverstripe/framework | ≥ 3.4.0&&< 3.4.2 | 3.4.2composer require silverstripe/framework:^3.4.2 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for silverstripe/framework, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update silverstripe/framework to 3.1.21 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-97jm-g33h-f46g is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Frequently Asked Questions
Is GHSA-97jm-g33h-f46g in your dependencies?
Find it across Packagist, including transitive dependencies.