What is GHSA-m338-cjqw-rxwv?

GHSA-m338-cjqw-rxwv is a security advisory published by GitHub Security Advisories with Medium severity. YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows...

Which CVE IDs does GHSA-m338-cjqw-rxwv cover?

GHSA-m338-cjqw-rxwv covers the following CVE IDs: CVE-2026-104465. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m338-cjqw-rxwv?

GHSA-m338-cjqw-rxwv has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-m338-cjqw-rxwvMediumCVSS 6.1

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows...

Vendor

GitHub Security Advisories

Published

October 2, 2026

Last Modified

October 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-104465 →

📋 Description

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in victims' browsers.

🔗 References (4)

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2fc6-rvp3-fgfj
https://nvd.nist.gov/vuln/detail/CVE-2026-104465
https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-reflected-xss-via-field-parameter-in-mail-handler
https://github.com/advisories/GHSA-m338-cjqw-rxwv