Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed
Priority LOW 38CWE-79Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
Zend_Filter_StripTags contained an optional setting to allow whitelisting HTML comments in filtered text. Microsoft Internet Explorer and several other browsers allow developers to create conditional functionality via HTML comments, including execution of script events and rendering of additional commented markup. By allowing whitelisting of HTML comments, a malicious user could potentially include XSS exploits within HTML comments that would then be rendered in the final output.
Why it matters now
Fix Fixed zendframework/zendframework1 (Packagist): 1.7.9, 1.8.5, 1.9.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | zendframework/zendframework1 (Packagist) | 1.7.0 to before 1.7.9 | 1.7.9 | Patch available | GHSA-4vf6-mq7w-3hp6 |
| — | zendframework/zendframework1 (Packagist) | 1.8.0 to before 1.8.5 | 1.8.5 | Patch available | GHSA-4vf6-mq7w-3hp6 |
| — | zendframework/zendframework1 (Packagist) | 1.9.0 to before 1.9.7 | 1.9.7 | Patch available | GHSA-4vf6-mq7w-3hp6 |
- zendframework/zendframework1 (Packagist) Vendor— Affected 1.7.0 to before 1.7.9 Fixed in 1.7.9 Patch available GHSA-4vf6-mq7w-3hp6
- zendframework/zendframework1 (Packagist) Vendor— Affected 1.8.0 to before 1.8.5 Fixed in 1.8.5 Patch available GHSA-4vf6-mq7w-3hp6
- zendframework/zendframework1 (Packagist) Vendor— Affected 1.9.0 to before 1.9.7 Fixed in 1.9.7 Patch available GHSA-4vf6-mq7w-3hp6
Remediation
- Fix · GHSA-4vf6-mq7w-3hp6 zendframework/zendframework1 (Packagist) Fixed in 1.7.9 Advisory →
- Fix · GHSA-4vf6-mq7w-3hp6 zendframework/zendframework1 (Packagist) Fixed in 1.8.5 Advisory →
- Fix · GHSA-4vf6-mq7w-3hp6 zendframework/zendframework1 (Packagist) Fixed in 1.9.7 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-4vf6-mq7w-3hp6
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences