Read the docs
TI-2024-29386 Aliases CVE-2024-43792

Halo's editor has a stored Cross-Site Scripting vulnerability

Priority MEDIUM 61CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed halo (halo-dev): 2.17.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
halo-devhalobefore 2.17.02.17.0Patch availableCNA
  • halo Vendorhalo-dev Affected before 2.17.0 Fixed in 2.17.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*before 2.17.0Vulnerablehalo-dev
  • cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:* Versions before 2.17.0 Vulnerable ·halo-dev

Remediation

  • Fix · CNA halo (halo-dev) Fixed in 2.17.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-43792

References

Exploit 1

  • TI-2025-28627 halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in… CVSS 3.1CRITICAL 9.1
  • TI-2025-43155 An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of… CVSS 3.1HIGH 7.5
  • TI-2024-29387 Halo's editor has a stored XSS vulnerability CVSS 3.1MEDIUM 6.4
  • TI-2022-14503 Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the… CVSS 3.1CRITICAL 9.8
  • TI-2022-14504 Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the… CVSS 3.1CRITICAL 9.8
  • TI-2020-14080 A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit… CVSS 3.1CRITICAL 9.8
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences