{"id":"GHSA-424m-fj2q-g7vg","summary":"Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors","details":"### Impact\n\nJavascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled.\n\n### Workaround\n\nIf the standard CSP rules are active (default in production mode), an exploit isn't possible.\n\n### Credits\n\nLwin Min Oo \u003clwinminoo2244@gmail.com\u003e","aliases":["CVE-2025-66468"],"modified":"2025-12-03T14:27:33.103899Z","published":"2025-12-03T14:05:28Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-12-03T14:05:28Z","nvd_published_at":"2025-12-02T19:15:53Z","cwe_ids":["CWE-79"]},"references":[{"type":"WEB","url":"https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66468"},{"type":"WEB","url":"https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042"},{"type":"PACKAGE","url":"https://github.com/aimeos/ai-cms-grapesjs"}],"affected":[{"package":{"name":"aimeos/ai-cms-grapesjs","ecosystem":"Packagist","purl":"pkg:composer/aimeos/ai-cms-grapesjs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2021.04.1"},{"fixed":"2021.10.8"}]}],"versions":["2021.04.1","2021.04.2","2021.04.3","2021.04.4","2021.04.5","2021.04.6","2021.07.1","2021.07.2","2021.07.3","2021.07.4","2021.07.5","2021.07.6","2021.07.7","2021.10.1","2021.10.2","2021.10.3","2021.10.4","2021.10.5","2021.10.6","2021.10.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-424m-fj2q-g7vg/GHSA-424m-fj2q-g7vg.json"}},{"package":{"name":"aimeos/ai-cms-grapesjs","ecosystem":"Packagist","purl":"pkg:composer/aimeos/ai-cms-grapesjs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2022.04.1"},{"fixed":"2022.10.9"}]}],"versions":["2022.04.1","2022.04.2","2022.04.3","2022.04.4","2022.07.1","2022.07.2","2022.07.3","2022.10.1","2022.10.2","2022.10.3","2022.10.4","2022.10.5","2022.10.6","2022.10.7","2022.10.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-424m-fj2q-g7vg/GHSA-424m-fj2q-g7vg.json"}},{"package":{"name":"aimeos/ai-cms-grapesjs","ecosystem":"Packagist","purl":"pkg:composer/aimeos/ai-cms-grapesjs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2023.04.1"},{"fixed":"2023.10.15"}]}],"versions":["2023.04.1","2023.04.2","2023.07.1","2023.07.2","2023.07.3","2023.07.4","2023.10.1","2023.10.10","2023.10.11","2023.10.12","2023.10.13","2023.10.14","2023.10.2","2023.10.3","2023.10.4","2023.10.5","2023.10.6","2023.10.7","2023.10.8","2023.10.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-424m-fj2q-g7vg/GHSA-424m-fj2q-g7vg.json"}},{"package":{"name":"aimeos/ai-cms-grapesjs","ecosystem":"Packagist","purl":"pkg:composer/aimeos/ai-cms-grapesjs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2024.04.1"},{"fixed":"2024.10.8"}]}],"versions":["2024.04.1","2024.04.2","2024.04.3","2024.04.4","2024.04.5","2024.04.6","2024.07.1","2024.07.2","2024.07.3","2024.10.1","2024.10.2","2024.10.3","2024.10.4","2024.10.5","2024.10.6","2024.10.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-424m-fj2q-g7vg/GHSA-424m-fj2q-g7vg.json"}},{"package":{"name":"aimeos/ai-cms-grapesjs","ecosystem":"Packagist","purl":"pkg:composer/aimeos/ai-cms-grapesjs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2025.04.1"},{"fixed":"2025.10.2"}]}],"versions":["2025.04.1","2025.04.2","2025.07.1","2025.07.2","2025.10.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-424m-fj2q-g7vg/GHSA-424m-fj2q-g7vg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"}]}