CVE-2026-56383

描述

A stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `Row Heading` column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. ## Prerequisites * An administrator account * `allowAdminChanges` must be enabled in production, which is [against security recommendations](https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production). ## Steps to Reproduce 1. Navigate to **Settings** → **Fields** and create a new field with Type: **Table** 1. Add a **Column Heading** and set **Column Type** to `Row Heading` 1. In **Default Values** section, add a row with the following payload: ```html <img src=x onerror="alert('XSS')"> ``` 1. Enable `Static Rows` 1. Use the field in any object (e.g., user profile fields) → then visit any user’s profile 1. Notice the XSS execution ## Resources https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a

如何修補 CVE-2026-56383

要修補 CVE-2026-56383,請將受影響套件升級到下列已修補版本。

• —升級至 4.16.19 或更新版本

CVE-2026-56383 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 4.5.0-beta.1, < 4.16.19

CVSS 分數

參考連結(6)

• PATCHgithub.com/craftcms/cms
• WEBcraftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
• WEBgithub.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a
• WEBgithub.com/craftcms/cms/releases/tag/4.16.19