What is GHSA-vx89-p3j7-8xqc?

GHSA-vx89-p3j7-8xqc is a security advisory published by GitHub Security Advisories with Medium severity. Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Which CVE IDs does GHSA-vx89-p3j7-8xqc cover?

GHSA-vx89-p3j7-8xqc covers the following CVE IDs: CVE-2026-71435. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vx89-p3j7-8xqc?

GHSA-vx89-p3j7-8xqc has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-vx89-p3j7-8xqc?

GHSA-vx89-p3j7-8xqc affects 2 products, including: composer/statamic/cms:\u003c 5.74.3; composer/statamic/cms:\u003e= 6.0.0, \u003c 6.24.2.

GHSA-vx89-p3j7-8xqcMediumCVSS 6.1

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Vendor

GitHub Security Advisories

Published

August 6, 2026

Last Modified

August 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-71435 →

📋 Description

Impact

The default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients

Patches

This has been fixed in 5.74.3 and 6.24.2.

🎯 Affected products2

composer/statamic/cms:< 5.74.3
composer/statamic/cms:>= 6.0.0, < 6.24.2

🔗 References (6)

https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc
https://github.com/statamic/cms/pull/14959
https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c
https://github.com/statamic/cms/releases/tag/v5.74.3
https://github.com/statamic/cms/releases/tag/v6.24.2
https://github.com/advisories/GHSA-vx89-p3j7-8xqc