Read the docs
TI-2024-29387 Aliases CVE-2024-43793

Halo's editor has a stored XSS vulnerability

Priority MEDIUM 64CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. This vulnerability is fixed in 2.19.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00325 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed halo (halo-dev): 2.19.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
halo-devhalobefore 2.19.02.19.0Patch availableCNA
  • halo Vendorhalo-dev Affected before 2.19.0 Fixed in 2.19.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*before 2.19.0Vulnerablehalo-dev
  • cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:* Versions before 2.19.0 Vulnerable ·halo-dev

Remediation

  • Fix · CNA halo (halo-dev) Fixed in 2.19.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-43793

References

Exploit 1

  • TI-2025-28627 halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in… CVSS 3.1CRITICAL 9.1
  • TI-2025-43155 An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of… CVSS 3.1HIGH 7.5
  • TI-2024-29386 Halo's editor has a stored Cross-Site Scripting vulnerability CVSS 3.1MEDIUM 6.3
  • TI-2022-14503 Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the… CVSS 3.1CRITICAL 9.8
  • TI-2022-14504 Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the… CVSS 3.1CRITICAL 9.8
  • TI-2020-14080 A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit… CVSS 3.1CRITICAL 9.8
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences