Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page

Description

Event log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability.

Recommendation

Update the @saltcorn/server package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0-beta.16
• Patched version(s): 1.0.0-beta.16

References

• GHSA-pf56-h9qf-rxq4
• CWE-79
• OWASP 2021-A3

Related Issues

• Cross-site Scripting (XSS) - Stored in crud-file-server - CVE-2018-3726
• Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables - CVE-2025-68115
• Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes - CVE-2024-6485
• CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - CVE-2025-58064

Tags:

npm

@saltcorn/server