TI-2026-21577 Aliases CVE-2026-27126 GHSA-3jh3-prx3-w6wc

Craft CMS has Stored XSS in Table Field via "HTML" Column Type

MEDIUM 60CWE-79Published 2026-02-24 · Updated 2026-02-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and `allowAdminChanges` must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00246 15th percentileScored 2026-11-07

Fix Fixed cms (craftcms): 4.16.19, 5.8.23craftcms/cms (Packagist): 4.16.19, 5.8.23

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Craft CMS	cms	4.5.0-RC1 to before 4.16.19; 5.0.0-RC1 to before 5.8.23	4.16.19, 5.8.23	Patch available	CNA
—	craftcms/cms (Packagist)	4.5.0-RC1 to before 4.16.19	4.16.19	Patch available	GHSA-3jh3-prx3-w6wc
—	craftcms/cms (Packagist)	5.0.0-RC1 to before 5.8.23	5.8.23	Patch available	GHSA-3jh3-prx3-w6wc

cms VendorCraft CMS Affected 4.5.0-RC1 to before 4.16.19; 5.0.0-RC1 to before 5.8.23 Fixed in 4.16.19, 5.8.23 Patch available CNA
craftcms/cms (Packagist) Vendor— Affected 4.5.0-RC1 to before 4.16.19 Fixed in 4.16.19 Patch available GHSA-3jh3-prx3-w6wc
craftcms/cms (Packagist) Vendor— Affected 5.0.0-RC1 to before 5.8.23 Fixed in 5.8.23 Patch available GHSA-3jh3-prx3-w6wc

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:craftcms:craft_cms::::::::	after 4.5.0, before 4.16.19; after 5.0.0, before 5.8.23	Vulnerable	Craft CMS
cpe:2.3:a:craftcms:craft_cms:4.5.0:-::::::	4.5.0	Vulnerable	Craft CMS
cpe:2.3:a:craftcms:craft_cms:4.5.0:rc1::::::	4.5.0 rc1	Vulnerable	Craft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:-::::::	5.0.0	Vulnerable	Craft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1::::::	5.0.0 rc1	Vulnerable	Craft CMS

cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* Versions after 4.5.0, before 4.16.19; after 5.0.0, before 5.8.23 Vulnerable ·Craft CMS
cpe:2.3:a:craftcms:craft_cms:4.5.0:-:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·Craft CMS
cpe:2.3:a:craftcms:craft_cms:4.5.0:rc1:*:*:*:*:*:* Versions 4.5.0 rc1 Vulnerable ·Craft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Craft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:* Versions 5.0.0 rc1 Vulnerable ·Craft CMS

Remediation

Fix · CNA cms (craftcms) Fixed in 4.16.19, 5.8.23
Fix · GHSA-3jh3-prx3-w6wc craftcms/cms (Packagist) Fixed in 4.16.19 Advisory →
Fix · GHSA-3jh3-prx3-w6wc craftcms/cms (Packagist) Fixed in 5.8.23 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-27126
2026-10-03 Alias added: GHSA-3jh3-prx3-w6wc

References

Patch 1

https://github.com/craftcms/cms/commit/f5d488d9bb6eff7670ed2c2fe30e15692e92c52b

Advisory 2

Other 1

https://github.com/craftcms/cms

TI-2025-23503 Craft CMS Allows Remote Code Execution KEVCVSS 3.1CRITICAL 10.0
TI-2024-37138 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms KEVCVSS 4.0CRITICAL 9.3
TI-2025-16994 Potential RCE with a compromised security key in craft/cms KEVCVSS 3.1HIGH 8.1
TI-2025-24595 Craft CMS stores user-provided content in session files KEVCVSS 4.0MEDIUM 6.9
TI-2023-22284 Craft CMS Remote Code Execution vulnerability CVSS 3.1CRITICAL 10.0
TI-2024-25171 Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. CVSS 3.1CRITICAL 9.8

See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences