How severe is GHSA-gxxh-8vcj-w2mh?

GHSA-gxxh-8vcj-w2mh has a CVSS score of 7.1/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by GHSA-gxxh-8vcj-w2mh?

GHSA-gxxh-8vcj-w2mh affects the following packages: mckenziearts/livewire-markdown-editor (Packagist). Ecosystems affected: Packagist.

How do I fix GHSA-gxxh-8vcj-w2mh?

Update mckenziearts/livewire-markdown-editor to 1.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gxxh-8vcj-w2mh is resolved across your whole dependency graph.

How do I detect GHSA-gxxh-8vcj-w2mh in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mckenziearts/livewire-markdown-editor, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-gxxh-8vcj-w2mh if there is no patch (or I can't update yet)?

Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Is GHSA-gxxh-8vcj-w2mh actively exploited in the wild?

No public exploit code has been indexed for GHSA-gxxh-8vcj-w2mh yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-gxxh-8vcj-w2mh published, and has it been updated?

GHSA-gxxh-8vcj-w2mh was published on May 4, 2026 and was last updated on May 5, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘

🐘 Packagist

Not in CISA KEV

HIGH severity

livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handlerGHSA-gxxh-8vcj-w2mh

HIGHFix: mckenziearts/livewire-markdown-editor@1e60eaa

GHSA-gxxh-8vcj-w2mh is a high-severity (CVSS 7.1) vulnerability in mckenziearts/livewire-markdown-editor. A fix is available for mckenziearts/livewire-markdown-editor — see the affected versions and patch details below.

Published

May 4, 2026

Updated

May 5, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of May 5, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐘mckenziearts/livewire-markdown-editor

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact

All versions of mckenziearts/livewire-markdown-editor prior to v1.3 contain a critical arbitrary file upload vulnerability in the MarkdownEditor::updatedAttachments() Livewire handler. The handler calls $file->store() with no server-side validation of MIME type, extension, or file content.

Any authenticated user with access to a page embedding <livewire:markdown-editor> can upload files of any type (.html, .svg, .js, .php, .exe, etc.) to the disk configured by livewire-markdown-editor.disk. When that disk is a public cloud bucket (S3, DigitalOcean Spaces, Cloudflare R2, Scaleway Object Storage — the common configuration when FILESYSTEM_DISK points to such a disk), uploaded files are served publicly with a guessed Content-Type header.

The consequences include:

Stored XSS on the storage domain via uploaded .html or .svg files
Phishing page hosting on the application's own storage domain (trust laundering)
Malware distribution from a domain users associate with the application
Markdown injection in the editor output via crafted filenames (the client-supplied getClientOriginalName() value was inserted verbatim into the markdown)

A real-world exploitation of this vulnerability was observed in production on a community platform using this package.

Patches

Upgrade to v1.3 or later.

Workarounds

If developers cannot upgrade immediately, disable the upload UI on every instance of the editor by passing :show-upload="false":

  <livewire:markdown-editor wire:model="content" :show-upload="false" />

This hides the file input and prevents the vulnerable code path from being reached.

Resources

Patch commit: https://github.com/mckenziearts/livewire-markdown-editor/pull/12
Release: https://github.com/mckenziearts/livewire-markdown-editor/releases/tag/v1.3
CWE-434: https://cwe.mitre.org/data/definitions/434.html
CWE-79: https://cwe.mitre.org/data/definitions/79.html

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`mckenziearts/livewire-markdown-editor`	all versions	1.3`composer require mckenziearts/livewire-markdown-editor:^1.3`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mckenziearts/livewire-markdown-editor, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update mckenziearts/livewire-markdown-editor to 1.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gxxh-8vcj-w2mh is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Impact All versions of `mckenziearts/livewire-markdown-editor` prior to **v1.3** contain a critical arbitrary file upload vulnerability in the `MarkdownEditor::updatedAttachments()` Livewire handler. The handler calls `$file->store()` with no server-side validation of MIME type, extension, or file content. Any authenticated user with access to a page embedding `<livewire:markdown-editor>` can upload files of any type (`.html`, `.svg`, `.js`, `.php`, `.exe`, etc.) to the disk configured by `livewire-markdown-editor.disk`. When that disk is a public cloud bucket (S3, DigitalOcean Spaces, Cl

O3 Security · Impact-Aware SCA

Is GHSA-gxxh-8vcj-w2mh in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works