Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe

Description

A stored cross-site scripting (XSS) vulnerability affected the Markdown/RichText field preview renderer in Sveltia CMS.

The DOMPurify sanitization configuration used for Markdown previews explicitly permitted iframe elements without enforcing a sandbox attribute or restricting iframe sources.

Recommendation

Update the @sveltia/cms package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.167.3
• Patched version(s): 0.167.3

References

• GHSA-h5jc-78hr-3pc9
• CWE-79
• OWASP 2021-A3

Related Issues

• Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML - Vulnerability
• Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - @haxtheweb/video-player - CVE-2026-46396
• Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - CVE-2026-46396
• Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

These 7 PHP mistakes leave your website open to the hackers

How do hackers hack websites?

Tags:

npm

@sveltia/cms