Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

GHSA-h5jc-78hr-3pc9

LowCVSS 1.1 / 10
Published Jun 19, 2026·Last modified Jun 19, 2026
Affected Components(0)

No affected components available

Description

Impact

A stored cross-site scripting (XSS) vulnerability affected the Markdown/RichText field preview renderer in Sveltia CMS.

The DOMPurify sanitization configuration used for Markdown previews explicitly permitted iframe elements without enforcing a sandbox attribute or restricting iframe sources. Sanitized Markdown output was then inserted into the CMS preview DOM as raw HTML. Because no sandboxing or source validation was applied, a Markdown field containing an iframe whose src pointed to a same-origin uploaded or publicly accessible HTML asset would render an unsandboxed iframe. JavaScript in the framed document could then access the parent CMS window via the browser’s same-origin policy, allowing it to read and write the parent window’s state, DOM, and browser storage, and to trigger actions in the CMS context.

The practical impact is limited in currently supported Sveltia CMS usage because the CMS is intended for a single developer or a small trusted team, and open authoring / untrusted multi-user authoring is not currently implemented. Exploitation requires the ability to place malicious content into the repository or content source that the CMS loads.

Patches

The issue has been patched by replacing the direct DOMPurify call in the Markdown preview renderer with a two-pass sanitization pipeline:

  1. DOMPurify processes the raw HTML as before.
  2. A post-processing step validates every iframe element in the sanitized output. Any iframe whose src does not use an https:// URL, uses a same-origin URL, uses a relative path, or uses any other non-HTTPS scheme (javascript:, data:, blob:, , etc.) is removed from the output. Surviving iframes (HTTPS cross-origin only) have a sandbox attribute enforced with at minimum allow-scripts allow-same-origin, which confines the framed document to its own origin and prevents it from accessing the parent CMS window.

Users should upgrade to Sveltia CMS v0.167.3 or later.

Workarounds

If upgrading is not immediately possible, avoid loading CMS content from untrusted authors and review Markdown field content for iframe elements pointing to same-origin or relative paths.

Administrators can also reduce exposure by limiting repository or content source write access to trusted users only.

References

Risk Scores
Base Score
1.1

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges.

Threat Intelligence
1.1

Limited exploitation activity has been observed. Close monitoring and planned remediation are recommended.

EPSS
N/A

Probability that this vulnerability will be exploited in the wild within the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Browse More

Low severity
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard