GHSA-97r8-rf7q-wmjw: Sveltia CMS Cross-Site Scripting Vulnerability
LOWGHSA-97r8-rf7q-wmjw is a LOW cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Sveltia CMS libraries in the npm ecosystem. The issue involves stored xss in entry summary rendering via entity-decoded html. Remediation is available by upgrading affected packages to version 0.160.1.
GHSA-97r8-rf7q-wmjw at a Glance
How to Fix GHSA-97r8-rf7q-wmjw
To remediate this vulnerability, upgrade all affected Sveltia CMS dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @sveltia/cms@0.160.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @sveltia/cmsHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-97r8-rf7q-wmjw, inspect your project dependencies using npm:
npm ls @sveltia/cmsAnalyze the terminal output to locate any version of Sveltia CMS in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.160.1), your application is affected.
Note: The npm ls @sveltia/cms command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Sveltia CMS, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-97r8-rf7q-wmjw Affected Sveltia CMS Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@sveltia/cms
|
npm |
< 0.160.1
|
0.160.1
|
References
Frequently Asked Questions
What is GHSA-97r8-rf7q-wmjw?
Which Sveltia CMS versions are affected?
What version fixes GHSA-97r8-rf7q-wmjw?
Is @sveltia/cms affected?
What CWE is associated with GHSA-97r8-rf7q-wmjw?
How can I check npm dependencies for GHSA-97r8-rf7q-wmjw?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-97r8-rf7q-wmjw",
"modified" : "2026-05-18T13:43:50Z",
"published" : "2026-05-18T13:43:50Z",
"aliases" : [ ],
"summary" : "Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML",
"details" : "### Impact\n\nA stored cross-site scripting (XSS) vulnerability affected entry summary rendering in Sveltia CMS.\n\nEntry summaries that allowed limited Markdown were parsed, sanitized, and then HTML entities were decoded. This order allowed specially crafted entity-encoded HTML, such as encoded tags or event handler attributes, to become active HTML after sanitization. When the resulting summary was rendered in the CMS UI, arbitrary JavaScript could execute in the browser of a user viewing the affected entry list or search result.\n\nThe practical impact is limited in currently supported Sveltia CMS usage because the CMS is intended for a single developer or a small trusted team, and [open authoring](https://sveltiacms.app/en/docs/workflows/open) / untrusted multi-user authoring is not currently implemented. Exploitation requires the ability to place malicious content into the repository or content source that the CMS loads.\n\n### Patches\n\nThe issue has been patched by changing entry summary sanitization so that HTML entity decoding happens before sanitization for Markdown-enabled summaries. This ensures any decoded HTML is processed by the sanitizer before being rendered.\n\nUsers should upgrade to Sveltia CMS [v0.160.1](https://github.com/sveltia/sveltia-cms/releases/tag/v0.160.1) or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible, avoid loading CMS content from untrusted authors and review content for entity-encoded HTML payloads in fields used by entry summaries.\n\nAdministrators can also reduce exposure by avoiding Markdown-enabled summary rendering for untrusted content where possible, or by ensuring repository write access is limited to trusted users only.\n\n### Resources\n\n- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n- https://cwe.mitre.org/data/definitions/79.html",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@sveltia/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.160.1"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "< 0.160.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/sveltia/sveltia-cms/security/advisories/GHSA-97r8-rf7q-wmjw"
}, {
"type" : "WEB",
"url" : "https://github.com/sveltia/sveltia-cms/commit/43a6ac5d0182a503400d8ce1ac156e08f537b1b2"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/sveltia/sveltia-cms"
}, {
"type" : "WEB",
"url" : "https://github.com/sveltia/sveltia-cms/releases/tag/v0.160.1"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-79" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2026-05-18T13:43:50Z",
"nvd_published_at" : null
}
}