js · @sveltia/cmsHeads-up
@sveltia/cms: Stored XSS in Markdown/RichText preview patched
A stored XSS vulnerability in the Markdown/RichText field preview renderer was patched by adding a two-pass sanitization pipeline that removes or sandboxes ifra
What changed
A stored XSS vulnerability in the Markdown/RichText field preview renderer was patched by adding a two-pass sanitization pipeline that removes or sandboxes iframes.
Who it affects
Users of Sveltia CMS who load Markdown content from untrusted sources or who have not upgraded to v0.167.3.
What to do today
Upgrade to Sveltia CMS v0.167.3 or later.
The trail
Collected→
Audited→
Written→
Published