GHSA-j543-vg33-g6vj: ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor`

June 7, 2024

Zend_Dojo_View_Helper_Editor was incorrectly decorating a TEXTAREA instead of a DIV. The Dojo team has reported that this has security implications as the rich text editor they use is unable to escape content for a TEXTAREA.

References

framework.zend.com/security/advisory/ZF2010-02
github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2010-02.yaml
github.com/advisories/GHSA-j543-vg33-g6vj
github.com/zendframework/zf1

Detect and mitigate GHSA-j543-vg33-g6vj with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →