npm/@umbraco-cms/backoffice CVE-2025-24012: medium 4.6, EPSS 0.27%
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components
Action: Upgrade @umbraco-cms/backoffice to 14.3.2 (14.x) or 15.1.2 (15.x) or later.
npm i @umbraco-cms/backoffice@14.3.2npm i @umbraco-cms/backoffice@15.1.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 14.0.0 | 14.3.2 | - |
| 15.0.0 | 15.1.2 | - |
Fixed versions
| 14.3.2 | 15.1.2 |
Sources
- osv: GHSA-wv8v-rmw2-25wc
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wv8v-rmw2-25wc
- https://nvd.nist.gov/vuln/detail/CVE-2025-24012
- https://github.com/umbraco/Umbraco-CMS/commit/d4f8754f933895b3a329296e25ddea6f84a0aea2
- https://github.com/umbraco/Umbraco-CMS
CVE-2025-24012 · published · modified · JSON