CVE-2026-56383 json
Craft CMS - Stored XSS in Table Field via Row Heading Column Type
published 2026-02-25 8 mo ago modified 2026-11-08 26 h ago also EUVD-2026-38177 , GHSA-6j87-m5qx-9fqp
- cvss
- 4.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.
Patch / fix
- packagist craftcms/cms 4.16.19, 5.8.23
- craftcms cms 4.16.19, 5.8.23
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/craftcms/cms/security/advisories/GHSA-6j87-m5qx-9fqp referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| CNA | 4.0 | 4.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | craftcms/cms | >=4.5.0-beta.1, <4.16.19 >=5.0.0-RC1, <5.8.23 |
4.16.19 5.8.23 |
Affected products
- craftcms cms
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a
patch, web
-
github.com
/craftcms/cms/security/advisories/GHSA-6j87-m5qx-9fqp
vendor-advisory, exploit, web
-
vulncheck.com
/advisories/craft-cms-stored-xss-in-table-field-via-row-heading-column-type
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-56383
advisory
-
craftcms.com
/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
web
-
github.com
/craftcms/cms
package
-
github.com
/craftcms/cms/releases/tag/4.16.19
web
-
github.com
/craftcms/cms/releases/tag/5.8.23
web
Sources
- CVE List CVE-2026-56383
- GitHub Advisory GHSA-6j87-m5qx-9fqp
- NVD CVE-2026-56383
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.