N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-jp3q-wwp3-pwv9

GHSA-jp3q-wwp3-pwv9: Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue

Summary An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens.

Affected Product

Ecosystem: Packagist (Craft CMS plugin)
Package: solspace/craft-freeform
Version: <= 5.14.6 (latest observed). Likely all 5.x until patched.

Details

Root cause: Multiple user-controlled strings (field labels, section labels, integration icons, short names, WYSIWYG previews) are injected into React components using dangerouslySetInnerHTML without sanitization.
Evidence: dangerouslySetInnerHTML on user-controlled properties in bundled CP JS at packages/plugin/src/Resources/js/client/client.js.

PoCs

Label-based XSS:
1. In Craft CP, create/edit a Freeform field and set its label to <img src=x onerror="alert('xss-label')">.
2. Open the form builder view containing the field.
3. Alert executes (stored XSS).
Integration icon SVG:
1. Set an integration "icon SVG" to <svg><script>alert('xss-icon')</script></svg>.
2. Open the integrations CP view.
3. Script executes.

Impact Arbitrary JS in admin CP; session/CSRF token theft; potential full admin takeover via DOM-driven actions.

Remediation

Sanitize/HTML-encode all user-controlled strings before passing to dangerouslySetInnerHTML, or avoid it for labels/titles/icons.
Server-side: strip/escape disallowed tags on save for fields, integration metadata, WYSIWYG content.
Add regression tests with <img onerror> payloads to ensure no execution in builder/integration views.

Workarounds

Restrict form-edit permissions to trusted admins only until patched.
Consider CSP that disallows inline scripts (defense-in-depth only).

Credits

Discovered by https://www.linkedin.com/in/praveenkavinda/ | Prav33N-Sec.

Disclosure / CVE Request

Request CVE for this confirmed stored XSS.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-jp3q-wwp3-pwv9

GHSA-jp3q-wwp3-pwv9:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
solspace/craft-freeform	composer	<= 5.14.6	5.14.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because user-controlled input is rendered in multiple React components using dangerouslySetInnerHTML without proper sanitization. This allows a low-privilege authenticated user, with permissions to edit forms or integrations, to inject arbitrary HTML and JavaScript. The injected code is then stored and executed in the browser of an administrator viewing the form builder or integration pages.

The patch addresses this by introducing the dompurify library to sanitize all user-provided strings before they are passed to dangerouslySetInnerHTML. The analysis of the commit b9adad6cdf1eba5400aae8b1ae39bd7d4d33af5e clearly shows the addition of sanitize() calls across numerous components where this unsafe rendering occurs. The identified vulnerable functions are React components that were directly using dangerouslySetInnerHTML on props that could be controlled by a user, such as form field labels, integration icons, and WYSIWYG content. Another identified vulnerability pattern was the use of jQuery's .html() method, which was replaced by the safer .text() method.

Vulnerable functions

Options

packages/client/src/app/components/elements/custom-dropdown/dropdown.options.tsx

The component `Options` renders a dropdown option's label using `dangerouslySetInnerHTML` without sanitization. An attacker could provide a malicious label, leading to stored XSS.

Dropdown

packages/client/src/app/components/elements/custom-dropdown/dropdown.tsx

The `Dropdown` component displays the selected option's label using `dangerouslySetInnerHTML` without sanitization. This could be exploited if the label contains malicious HTML/JS.

FieldCell

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.