CVE-2026-56383: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in craftcms cms
A stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `Row Heading` column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. ## Prerequisites * An administrator account * `allowAdminChanges` must be enabled in production, which is [against security recommendations](https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production). ## Steps to Reproduce 1. Navigate to **Settings** → **Fields** and create a new field with Type: **Table** 1. Add a **Column Heading** and set **Column Type** to `Row Heading` 1. In **Default Values** section, add a row with the following payload: ```html <img src=x onerror="alert('XSS')"> ``` 1. Enable `Static Rows` 1. Use the field in any object (e.g., user profile fields) → then visit any user’s profile 1. Notice the XSS execution ## Resources https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a
AI Analysis
Technical Summary
CVE-2026-56383 is a stored cross-site scripting vulnerability in Craft CMS affecting the editableTable.twig component's 'Row Heading' column type. The vulnerability arises because the application does not properly sanitize input in row heading default values, enabling an administrator with allowAdminChanges enabled to inject JavaScript code. This code executes in the context of other users viewing the affected table field, potentially leading to session hijacking or other script-based attacks. The vulnerability affects versions >=4.5.0-beta.1 through 4.16.18 and >=5.0.0-RC1 through 5.8.22 and is resolved in versions 4.16.19 and 5.8.23.
Potential Impact
An attacker with administrator privileges and allowAdminChanges enabled can inject arbitrary JavaScript code that executes in the browsers of other users viewing the affected table field. This can lead to typical XSS impacts such as session hijacking, unauthorized actions, or data theft. The vulnerability requires high privileges (administrator) and user interaction (viewing the affected page). The CVSS 4.0 score is 4.6 (medium severity), reflecting the need for elevated privileges and user interaction.
Mitigation Recommendations
Upgrade Craft CMS to version 4.16.19 or later if using the 4.x branch, or to version 5.8.23 or later if using the 5.x branch. These versions contain the fix for this stored XSS vulnerability. No other mitigations are indicated. Patch status is confirmed fixed in these versions.
CVE-2026-56383: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in craftcms cms
Description
A stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `Row Heading` column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. ## Prerequisites * An administrator account * `allowAdminChanges` must be enabled in production, which is [against security recommendations](https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production). ## Steps to Reproduce 1. Navigate to **Settings** → **Fields** and create a new field with Type: **Table** 1. Add a **Column Heading** and set **Column Type** to `Row Heading` 1. In **Default Values** section, add a row with the following payload: ```html <img src=x onerror="alert('XSS')"> ``` 1. Enable `Static Rows` 1. Use the field in any object (e.g., user profile fields) → then visit any user’s profile 1. Notice the XSS execution ## Resources https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a
CVSS v4.0
Score 4.6medium
Affected software
craftcms
cms
pkg:github/craftcms/cmsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56383 is a stored cross-site scripting vulnerability in Craft CMS affecting the editableTable.twig component's 'Row Heading' column type. The vulnerability arises because the application does not properly sanitize input in row heading default values, enabling an administrator with allowAdminChanges enabled to inject JavaScript code. This code executes in the context of other users viewing the affected table field, potentially leading to session hijacking or other script-based attacks. The vulnerability affects versions >=4.5.0-beta.1 through 4.16.18 and >=5.0.0-RC1 through 5.8.22 and is resolved in versions 4.16.19 and 5.8.23.
Potential Impact
An attacker with administrator privileges and allowAdminChanges enabled can inject arbitrary JavaScript code that executes in the browsers of other users viewing the affected table field. This can lead to typical XSS impacts such as session hijacking, unauthorized actions, or data theft. The vulnerability requires high privileges (administrator) and user interaction (viewing the affected page). The CVSS 4.0 score is 4.6 (medium severity), reflecting the need for elevated privileges and user interaction.
Mitigation Recommendations
Upgrade Craft CMS to version 4.16.19 or later if using the 4.x branch, or to version 5.8.23 or later if using the 5.x branch. These versions contain the fix for this stored XSS vulnerability. No other mitigations are indicated. Patch status is confirmed fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-21T02:05:47.495Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a37ed4baaf2dc2701b2275f
Added to database: 06/21/2026, 13:55:23 UTC
Last enriched: 06/28/2026, 21:46:39 UTC
Last updated: 09/17/2026, 22:01:36 UTC
Views: 95
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.