Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML

Description

A stored cross-site scripting (XSS) vulnerability affected entry summary rendering in Sveltia CMS.

Entry summaries that allowed limited Markdown were parsed, sanitized, and then HTML entities were decoded.

Recommendation

Update the @sveltia/cms package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.160.0
• Patched version(s): 0.160.1

References

• GHSA-97r8-rf7q-wmjw
• CWE-79
• OWASP 2021-A3

Related Issues

• Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe - Vulnerability
• Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - @haxtheweb/video-player - CVE-2026-46396
• HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft - CVE-2026-46496
• Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - CVE-2026-46396

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

These 7 PHP mistakes leave your website open to the hackers

How do hackers hack websites?

Tags:

npm

@sveltia/cms