CVE-2026-55790: Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

July 6, 2026

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s “Give feedback” screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

References

github.com/advisories/GHSA-24x4-j6x9-rfw5
github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417
github.com/craftcms/cms/security/advisories/GHSA-24x4-j6x9-rfw5
nvd.nist.gov/vuln/detail/CVE-2026-55790

Code Behaviors & Features

Detect and mitigate CVE-2026-55790 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →