{"action":"Upgrade statamic/cms to 5.74.3 or later.","affected":[{"fixed":"5.74.3","introduced":"0"},{"fixed":"6.24.2","introduced":"6.0.0"}],"component":"statamic/cms","cve_ids":["CVE-2026-71435"],"ecosystem":"Packagist","epss":0.00338,"exploited":false,"fixed_versions":["5.74.3","6.24.2"],"ghsa_id":"GHSA-vx89-p3j7-8xqc","id":"tcs_01M5KF9HPVZV8MH22441M2EXEK","modified_at":"2026-08-06T19:56:06.280620Z","published_at":"2026-08-06T19:37:58Z","references":["https://osv.dev/vulnerability/GHSA-vx89-p3j7-8xqc","https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc","https://github.com/statamic/cms/pull/14959","https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c","https://github.com/statamic/cms","https://github.com/statamic/cms/releases/tag/v5.74.3","https://github.com/statamic/cms/releases/tag/v6.24.2"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-vx89-p3j7-8xqc","url":"https://osv.dev/vulnerability/GHSA-vx89-p3j7-8xqc"}],"summary":"Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template"}