CVE-2026-55790: Craft CMS DOM XSS Vulnerability via GitHub Issue Title
Summary
CVE-2026-55790: Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget. Affects craftcms/cms across 2 version ranges.
>= 4.0.0-RC1, < 4.17.16
>= 5.0.0-RC1, < 5.9.23
Fixed in 4.17.16 or 5.9.23, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is a flexible content management system designed for developers and content creators. It allows users to build custom websites and applications with ease. The platform is known for its user-friendly interface, robust features, and extensibility through plugins. However, it is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack due to improper handling of GitHub issue titles in the CraftSupport widget.
Vulnerability Detail
The vulnerability arises from the CraftSupport widget's handling of search results from the GitHub API. An attacker can create a GitHub issue with a malicious title containing JavaScript payloads. When an administrator uses the CraftSupport widget to search for this issue, the payload executes in the admin's control panel session, leading to potential unauthorized actions. This vulnerability does not require elevated privileges for the attacker, making it particularly dangerous.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0-RC1, < 4.17.164.17.16composer require craftcms/cms:4.17.16 -
>= 5.0.0-RC1, < 5.9.235.9.23composer require craftcms/cms:5.9.23
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators should avoid using the 'Give feedback' search feature in the CraftSupport widget until the package is updated. Additionally, ensure that only trusted users have access to the Craft CMS admin panel.
Conclusion
The Craft CMS vulnerability CVE-2026-55790 presents a significant risk due to its ease of exploitation and potential impact on admin sessions. It is crucial for users to update to the latest patched versions of the software and to implement recommended workarounds until the update is applied.
See every vulnerability recorded for craftcms/cms →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
No, the attacker only needs a GitHub account to exploit this vulnerability; control panel access is not required.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability allows an attacker to execute JavaScript in the admin's session, potentially leading to unauthorized actions and data exposure.
Yes, avoid using the 'Give feedback' feature in the CraftSupport widget and limit admin access to trusted users.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
