Zend-Navigation vulnerable to Cross-site Scripting
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Tampering
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-352.
Summary
Many Zend Framework 2 view helpers were using the `escapeHtml()` view helper in order to escape HTML attributes, instead of the more appropriate `escapeHtmlAttr()`. In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scripting (XSS) attack vectors. Vulnerable view helpers include: - All `Zend\Form` view helpers. - Most `Zend\Navigation` (aka `Zend\View\Helper\Navigation\*`) view helpers. - All "HTML Element" view helpers: `htmlFlash()`, `htmlPage()`, `htmlQuickTime()`. - `Zend\View\Helper\Gravatar`
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | zendframework/zend-navigation (Packagist) | 2.0.0 to before 2.2.7 | 2.2.7 | Patch available | GHSA-6v7p-5qcq-268c |
| — | zendframework/zend-navigation (Packagist) | 2.3.0 to before 2.3.1 | 2.3.1 | Patch available | GHSA-6v7p-5qcq-268c |
- zendframework/zend-navigation (Packagist) Vendor— Affected 2.0.0 to before 2.2.7 Fixed in 2.2.7 Patch available GHSA-6v7p-5qcq-268c
- zendframework/zend-navigation (Packagist) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-6v7p-5qcq-268c
Remediation
- Fix · GHSA-6v7p-5qcq-268c zendframework/zend-navigation (Packagist) Fixed in 2.2.7 Advisory →
- Fix · GHSA-6v7p-5qcq-268c zendframework/zend-navigation (Packagist) Fixed in 2.3.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-6v7p-5qcq-268c
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences