Kirby CMS versions before 4.9.1 and 5.4.1 have an improper neutralization of input vulnerability (CWE-79) in the URL methods used by KirbyTags and image blocks. These components generate anchor tags from editor-supplied field values without adequately filtering malicious URL schemes. Although simple javascript: URLs were blocked by prepending a slash, URLs like javascript://x%0A... bypass this protection. Other schemes such as vbscript:, data:, livescript:, mocha:, and jar: are similarly exploitable. This vulnerability allows injection of script code via crafted URLs, potentially leading to cross-site scripting attacks. The vulnerability has been addressed in Kirby versions 4.9.1 and 5.4.1.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application by injecting malicious URLs into editor-supplied fields that render as links. This can lead to high-impact consequences such as session hijacking, defacement, or other client-side attacks. The CVSS 4.0 score is 8.4 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality and integrity.

Upgrade affected Kirby CMS installations to version 4.9.1 or later, or 5.4.1 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Patch status is confirmed fixed in these versions.