XSS/HTML Injection Vulnerability in Umbraco Backoffice Components

Description

Authenticated users are able to exploit an XSS vulnerability when viewing certain localized backoffice components.

Recommendation

Update the @umbraco-cms/backoffice package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 15.0.0, < 15.1.2

  >= 14.0.0, < 14.3.2**

• Patched version(s): **15.1.2

  14.3.2**

References

• GHSA-wv8v-rmw2-25wc
• CVE-2025-24012
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) - CVE-2025-8101
• Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
• QMarkdown Cross-Site Scripting (XSS) vulnerability - CVE-2025-43954
• gifplayer XSS vulnerability - CVE-2025-31128

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

@umbraco-cms/backoffice