Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors
Priority LOW 33CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.003 22nd percentileScored 2026-11-07
Fix Fixed ai-cms-grapesjs (aimeos): 2021.10.8, 2022.10.9, 2023.10.15 +2aimeos/ai-cms-grapesjs (Packagist): 2021.10.8, 2022.10.9, 2023.10.15 +2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aimeos | ai-cms-grapesjs | 2021.04.1 to before 2021.10.8; 2022.04.1 to before 2022.10.9; 2023.04.1 to before 2023.10.15; 2024.04.1 to before 2024.10.8; 2025.04.1 to before 2025.10.2 | 2021.10.8, 2022.10.9, 2023.10.15, 2024.10.8, 2025.10.2 | Patch available | CNA |
| — | aimeos/ai-cms-grapesjs (Packagist) | 2021.04.1 to before 2021.10.8 | 2021.10.8 | Patch available | GHSA-424m-fj2q-g7vg |
| — | aimeos/ai-cms-grapesjs (Packagist) | 2022.04.1 to before 2022.10.9 | 2022.10.9 | Patch available | GHSA-424m-fj2q-g7vg |
| — | aimeos/ai-cms-grapesjs (Packagist) | 2023.04.1 to before 2023.10.15 | 2023.10.15 | Patch available | GHSA-424m-fj2q-g7vg |
| — | aimeos/ai-cms-grapesjs (Packagist) | 2024.04.1 to before 2024.10.8 | 2024.10.8 | Patch available | GHSA-424m-fj2q-g7vg |
| — | aimeos/ai-cms-grapesjs (Packagist) | 2025.04.1 to before 2025.10.2 | 2025.10.2 | Patch available | GHSA-424m-fj2q-g7vg |
- ai-cms-grapesjs Vendoraimeos Affected 2021.04.1 to before 2021.10.8; 2022.04.1 to before 2022.10.9; 2023.04.1 to before 2023.10.15; 2024.04.1 to before 2024.10.8; 2025.04.1 to before 2025.10.2 Fixed in 2021.10.8, 2022.10.9, 2023.10.15, 2024.10.8, 2025.10.2 Patch available CNA
- aimeos/ai-cms-grapesjs (Packagist) Vendor— Affected 2021.04.1 to before 2021.10.8 Fixed in 2021.10.8 Patch available GHSA-424m-fj2q-g7vg
- aimeos/ai-cms-grapesjs (Packagist) Vendor— Affected 2022.04.1 to before 2022.10.9 Fixed in 2022.10.9 Patch available GHSA-424m-fj2q-g7vg
- aimeos/ai-cms-grapesjs (Packagist) Vendor— Affected 2023.04.1 to before 2023.10.15 Fixed in 2023.10.15 Patch available GHSA-424m-fj2q-g7vg
- aimeos/ai-cms-grapesjs (Packagist) Vendor— Affected 2024.04.1 to before 2024.10.8 Fixed in 2024.10.8 Patch available GHSA-424m-fj2q-g7vg
- aimeos/ai-cms-grapesjs (Packagist) Vendor— Affected 2025.04.1 to before 2025.10.2 Fixed in 2025.10.2 Patch available GHSA-424m-fj2q-g7vg
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:aimeos:grapesjs_cms:*:*:*:*:*:*:*:* | 2021.04.1 to before 2021.10.8; 2022.04.1 to before 2022.10.9; 2023.04.1 to before 2023.10.15; 2024.04.1 to before 2024.10.8; 2025.04.1 to before 2025.10.2 | Vulnerable | aimeos |
- cpe:2.3:a:aimeos:grapesjs_cms:*:*:*:*:*:*:*:* Versions 2021.04.1 to before 2021.10.8; 2022.04.1 to before 2022.10.9; 2023.04.1 to before 2023.10.15; 2024.04.1 to before 2024.10.8; 2025.04.1 to before 2025.10.2 Vulnerable ·aimeos
Remediation
- Fix · CNA ai-cms-grapesjs (aimeos) Fixed in 2021.10.8, 2022.10.9, 2023.10.15, 2024.10.8, 2025.10.2
- Fix · GHSA-424m-fj2q-g7vg aimeos/ai-cms-grapesjs (Packagist) Fixed in 2021.10.8 Advisory →
- Fix · GHSA-424m-fj2q-g7vg aimeos/ai-cms-grapesjs (Packagist) Fixed in 2022.10.9 Advisory →
- Fix · GHSA-424m-fj2q-g7vg aimeos/ai-cms-grapesjs (Packagist) Fixed in 2023.10.15 Advisory →
- Fix · GHSA-424m-fj2q-g7vg aimeos/ai-cms-grapesjs (Packagist) Fixed in 2024.10.8 Advisory →
- Fix · GHSA-424m-fj2q-g7vg aimeos/ai-cms-grapesjs (Packagist) Fixed in 2025.10.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-66468
- 2026-10-03 Alias added: GHSA-424m-fj2q-g7vg
References
Sources
- CVE-2025-66468 · CVE Program
- CVE-2025-66468 · NVD
- FIRST EPSS
- GHSA-424m-fj2q-g7vg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences