{"action":"Upgrade craftcms/cms to 4.16.19 or later.","affected":[{"fixed":"4.16.19","introduced":"4.5.0-beta.1"},{"fixed":"5.8.23","introduced":"5.0.0-RC1"}],"component":"craftcms/cms","cve_ids":["CVE-2026-56383"],"ecosystem":"Packagist","epss":0.00309,"exploited":false,"fixed_versions":["4.16.19","5.8.23"],"ghsa_id":"GHSA-6j87-m5qx-9fqp","id":"tcs_01M5KEX4YA89PMXHT18CJX591R","modified_at":"2026-08-06T21:01:02.041031618Z","published_at":"2026-02-25T19:11:31Z","references":["https://osv.dev/vulnerability/GHSA-6j87-m5qx-9fqp","https://github.com/craftcms/cms/security/advisories/GHSA-6j87-m5qx-9fqp","https://nvd.nist.gov/vuln/detail/CVE-2026-56383","https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a","https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production","https://github.com/craftcms/cms","https://github.com/craftcms/cms/releases/tag/4.16.19","https://github.com/craftcms/cms/releases/tag/5.8.23","https://www.vulncheck.com/advisories/craft-cms-stored-xss-in-table-field-via-row-heading-column-type"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-6j87-m5qx-9fqp","url":"https://osv.dev/vulnerability/GHSA-6j87-m5qx-9fqp"}],"summary":"Craft CMS has Stored XSS in Table Field in its \"Row Heading\" Column Type"}