{"id":"GHSA-6f85-3f8q-qc94","summary":"OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor","details":"# Impact\nDue to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager\n\n# Relates to\n - [https://github.com/artf/grapesjs/issues/4411](https://github.com/artf/grapesjs/issues/4411)\n\n# Patch\nUpdate GrapeJS dependency to \u003e=[v0.19.5](https://github.com/artf/grapesjs/releases/tag/v0.19.5)\n","modified":"2024-12-08T05:39:08.302350Z","published":"2022-07-15T19:25:06Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-07-15T19:25:06Z","nvd_published_at":null,"cwe_ids":["CWE-79"]},"references":[{"type":"WEB","url":"https://github.com/oroinc/orocommerce/security/advisories/GHSA-6f85-3f8q-qc94"},{"type":"WEB","url":"https://github.com/artf/grapesjs/issues/4411"},{"type":"PACKAGE","url":"https://github.com/oroinc/orocommerce"}],"affected":[{"package":{"name":"oro/commerce","ecosystem":"Packagist","purl":"pkg:composer/oro/commerce"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.4"}]}],"versions":["5.0.0","5.0.0-alpha.1","5.0.0-alpha.2","5.0.0-beta.1","5.0.0-beta.2","5.0.0-rc","5.0.1","5.0.2","5.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-6f85-3f8q-qc94/GHSA-6f85-3f8q-qc94.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N"}]}