GHSA-rc5r-697f-28x6MediumCVSS 4.8
XSS injection in the Grid component of Sylius
🔗 CVE IDs covered (1)
📋 Description
Grid component of Sylius omits HTML input sanitisation while rendering object implementing __toString() method through the string field type.
🎯 Affected products14
- composer/sylius/grid:>= 1.0.0, < 1.1.19
- composer/sylius/grid:>= 1.2.0, < 1.2.18
- composer/sylius/grid:>= 1.3.0, < 1.3.13
- composer/sylius/grid:>= 1.4.0, < 1.4.5
- composer/sylius/grid:>= 1.5.0, < 1.5.1
- composer/sylius/grid-bundle:>= 1.0.0, < 1.1.19
- composer/sylius/grid-bundle:>= 1.2.0, < 1.2.18
- composer/sylius/grid-bundle:>= 1.3.0, < 1.3.13
- composer/sylius/grid-bundle:>= 1.4.0, < 1.4.5
- composer/sylius/grid-bundle:>= 1.5.0, < 1.5.1
- composer/sylius/sylius:>= 1.0.0, < 1.1.18
- composer/sylius/sylius:>= 1.2.0, < 1.2.17
- composer/sylius/sylius:>= 1.3.0, < 1.3.12
- composer/sylius/sylius:>= 1.4.0, < 1.4.4
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2019-12186
- https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/grid/CVE-2019-12186.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/CVE-2019-12186.yaml
- https://sylius.com/blog/cve-2019-12186
- https://github.com/advisories/GHSA-rc5r-697f-28x6