CVE-2021-3841: Cross site scripting in sylius/sylius

November 15, 2024

sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user’s browser.

References

github.com/advisories/GHSA-hhvr-2q69-4563
github.com/sylius/sylius
github.com/sylius/sylius/commit/3da169e0c23e752974d74223cc536c29a2a82edc
huntr.com/bounties/1625506791178-Sylius/Sylius
nvd.nist.gov/vuln/detail/CVE-2021-3841

Detect and mitigate CVE-2021-3841 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →