NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

Formwork has a cross-site scripting (XSS) vulnerability in Site titleGHSA-vf6x-59hh-332f

MEDIUMFix: getformwork/formwork@aa3e9c6

GHSA-vf6x-59hh-332f is a medium-severity (CVSS 4.7) vulnerability in getformwork/formwork. A fix is available for getformwork/formwork — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Feb 18, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐘getformwork/formwork

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

The site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.

Impact

The attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.

Patches

Details

By embedding "<!--", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistgetformwork/formwork≥ 2.0.0-beta.3&&< 2.0.0-beta.42.0.0-beta.4composer require getformwork/formwork:^2.0.0-beta.4

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for getformwork/formwork, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update getformwork/formwork to 2.0.0-beta.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vf6x-59hh-332f is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Summary The site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users. ### Impact The attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability. ### Patches - [**Formwork 2.x** (aa3e9c6)](https://github.com/getformwork/formwork/commit/aa3e9c684035d9e8495169fde7c57d97faa3f9a2) escapes site title from panel header navigation. ### Details By embedding "<!--", the source code can be
O3 Security · Impact-Aware SCA

Is GHSA-vf6x-59hh-332f in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Formwork has a cross-site scripting (XSS) vulnerability in…