Read the docs
TI-2024-32040 Aliases CVE-2024-47765GHSA-q898-frwq-f3qp

Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS

Priority MEDIUM 64CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Minecraft MOTD Parser is a PHP library to parse minecraft server motd. The HtmlGenerator class is subject to potential cross-site scripting (XSS) attack through a parsed malformed Minecraft server MOTD. The HtmlGenerator iterates through objects of MotdItem that are contained in an object of MotdItemCollection to generate a HTML string. An attacker can make malicious inputs to the color and text properties of MotdItem to inject own HTML into a web page during web page generation. For example by sending a malicious MOTD from a Minecraft server under their control that was queried and passed to the HtmlGenerator. This XSS vulnerability exists because the values of these properties are neither filtered nor escaped. This vulnerability is fixed in 1.0.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00389 33rd percentileScored 2026-11-07
Fix Fixed MinecraftMotdParser (jgniecki): 1.0.6dev-lancer/minecraft-motd-parser (Packagist): 1.0.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jgnieckiMinecraftMotdParserbefore 1.0.61.0.6Patch availableCNA
—dev-lancer/minecraft-motd-parser (Packagist)before 1.0.61.0.6Patch availableGHSA-q898-frwq-f3qp
  • MinecraftMotdParser Vendorjgniecki Affected before 1.0.6 Fixed in 1.0.6 Patch available CNA
  • dev-lancer/minecraft-motd-parser (Packagist) Vendor— Affected before 1.0.6 Fixed in 1.0.6 Patch available GHSA-q898-frwq-f3qp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jgniecki:minecraft_motd_parser:*:*:*:*:*:*:*:*before 1.0.6Vulnerablejgniecki
  • cpe:2.3:a:jgniecki:minecraft_motd_parser:*:*:*:*:*:*:*:* Versions before 1.0.6 Vulnerable ·jgniecki

Remediation

  • Fix · CNA MinecraftMotdParser (jgniecki) Fixed in 1.0.6
  • Fix · GHSA-q898-frwq-f3qp dev-lancer/minecraft-motd-parser (Packagist) Fixed in 1.0.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-47765
  2. 2026-10-03 Alias added: GHSA-q898-frwq-f3qp

References

Patch 1

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences