{"id":"CVE-2026-55790","aliases":["GHSA-24x4-j6x9-rfw5"],"title":"Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget","summary":"Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget","severity":"high","cwe":["CWE-79"],"vendor":"craftcms","product":"craftcms/cms","ecosystem":"composer","affected":["craftcms/cms >= 5.0.0-RC1, < 5.9.22","craftcms/cms >= 4.0.0-RC1, < 4.17.15"],"patched":["craftcms/cms 5.9.23","craftcms/cms 4.17.16"],"published":"2026-07-06","updated":"2026-07-06","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-24x4-j6x9-rfw5","references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-24x4-j6x9-rfw5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55790"},{"url":"https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417"},{"url":"https://github.com/advisories/GHSA-24x4-j6x9-rfw5"}],"tags":["ghsa","composer"],"epss":0.00461,"epssPercentile":0.39109,"ingestedAt":"2026-07-06T21:45:52.924Z","slug":"CVE-2026-55790","body":"## Overview\n\n## Summary\n\nAn attacker with only a GitHub account can plant a JavaScript payload in a `craftcms/cms` issue title. When a Craft admin uses the CraftSupport widget’s \"Give feedback\" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.\n\nNo control panel account or elevated privileges are required on the attacker’s side.\n\n## Preconditions\n\n- Attacker has a GitHub account (no control panel access needed).\n- Victim is an administrator, and you have the CraftSupport widget on the dashboard.\n- Victim uses the \"Give feedback\" screen and types a search term that returns the poisoned issue.\n\n## Root cause\n\n`CraftSupportWidget.js` lines 382-392:\n\n```js\n$('<a>', {\n  href: this.getSearchResultUrl(results[i]),\n  target: '_blank',\n  html:\n    '<span class=\"status ' +\n    this.getSearchResultStatus(results[i]) +\n    '\"></span>' +\n    this.getSearchResultText(results[i]),\n})\n```\n\n`FeedbackScreen.getSearchResultText` (line 669-671) returns `result.title` verbatim from the GitHub API response. The jQuery `html:` option sets the element’s `innerHTML`, so a title containing `<img src=x onerror=...>` executes immediately on render.\n\nThe GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.\n\n`HelpScreen` (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.\n\n## Steps to reproduce\n\n**Plant (attacker, GitHub account only):**\n\n1. Open `https://github.com/craftcms/cms/issues/new`.\n2. Set the title to a string combining a plausible search term and the payload, e.g.:\n\n```\n<img src=x onerror=alert(document.domain)> cannot upload files\n```\n\n3. Submit the issue.\n\n**Trigger (victim, Craft admin):**\n\n1. Open the Craft control panel dashboard.\n2. Open the CraftSupport widget, click \"Give feedback\".\n3. Type `cannot upload files` in the search box.\n4. `alert(document.domain)` fires in the admin's session.\n\n## Impact\n\nXSS in the admin control panel session. The payload has access to `Craft.csrfTokenName` and `Craft.csrfTokenValue` and can send same-origin action requests as the admin without any further interaction.\n\n## Mitigating factors\n\n- Victim must actively use the \"Give feedback\" search screen.\n- Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.\n- Widget is only available to admins.\n\n## Resources\n\nhttps://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417\n\n## Affected packages\n\n- `craftcms/cms >= 5.0.0-RC1, < 5.9.22`\n- `craftcms/cms >= 4.0.0-RC1, < 4.17.15`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `craftcms/cms 5.9.23`\n- `craftcms/cms 4.17.16`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}