{"action":"Upgrade neos/neos to 5.3.10 or later.","affected":[{"fixed":"5.3.10","introduced":"3.3"},{"fixed":"7.0.9","introduced":"7.0.0"},{"fixed":"7.1.7","introduced":"7.1.0"},{"fixed":"7.2.6","introduced":"7.2.0"},{"fixed":"7.3.4","introduced":"7.3.0"},{"fixed":"8.0.2","introduced":"8.0.0"}],"component":"neos/neos","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["5.3.10","7.0.9","7.1.7","7.2.6","7.3.4","8.0.2"],"ghsa_id":"GHSA-jfxf-4frr-9j3q","id":"tcs_01M5KF4HEVT4DG6XG52TV3AF9H","modified_at":"2024-12-07T05:48:12.619861Z","published_at":"2022-05-25T19:38:50Z","references":["https://osv.dev/vulnerability/GHSA-jfxf-4frr-9j3q","https://github.com/neos/neos-development-collection/security/advisories/GHSA-jfxf-4frr-9j3q","https://discuss.neos.io/t/neos-bugfix-releases-5-3-10-7-0-9-7-1-7-7-2-6-7-3-4-8-0-2/5930?u=kdambekalns","https://github.com/neos/neos","https://www.neos.io/blog/xss-in-various-backend-modules.html"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-jfxf-4frr-9j3q","url":"https://osv.dev/vulnerability/GHSA-jfxf-4frr-9j3q"}],"summary":"XSS in various backend modules due to (un)escaping in JS notification module"}