What is GHSA-643g-3jrv-qcww?

GHSA-643g-3jrv-qcww is a security advisory published by GitHub Security Advisories with unknown severity. Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape...

Which CVE IDs does GHSA-643g-3jrv-qcww cover?

GHSA-643g-3jrv-qcww covers the following CVE IDs: CVE-2026-103527. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-643g-3jrv-qcwwunknown

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape...

Vendor

GitHub Security Advisories

Published

October 12, 2026

Last Modified

October 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-103527 →

📋 Description

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-103527
https://kb.cert.org/vuls/id/162329
https://github.com/advisories/GHSA-643g-3jrv-qcww