{"action":"Upgrade mckenziearts/livewire-markdown-editor to 1.3 or later.","affected":[{"fixed":"1.3","introduced":"0"}],"component":"mckenziearts/livewire-markdown-editor","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["1.3"],"ghsa_id":"GHSA-gxxh-8vcj-w2mh","id":"tcs_01M5KF3737NJ49TJ3YFWZ96XQE","modified_at":"2026-05-05T16:13:01.980844Z","published_at":"2026-05-04T22:11:05Z","references":["https://osv.dev/vulnerability/GHSA-gxxh-8vcj-w2mh","https://github.com/mckenziearts/livewire-markdown-editor/security/advisories/GHSA-gxxh-8vcj-w2mh","https://github.com/mckenziearts/livewire-markdown-editor/commit/1e60eaa5781e89704e112425f832774be85cd71f","https://github.com/mckenziearts/livewire-markdown-editor","https://github.com/mckenziearts/livewire-markdown-editor/releases/tag/v1.3"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-gxxh-8vcj-w2mh","url":"https://osv.dev/vulnerability/GHSA-gxxh-8vcj-w2mh"}],"summary":"livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler"}