VDB
KO
MEDIUM 6.1

GHSA-vx89-p3j7-8xqc

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Quick fix

GHSA-vx89-p3j7-8xqc — statamic/cms: upgrade to the fixed version with the command below. 

composer require statamic/cms:^5.74.3

Details

### Impact

The default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients

### Patches

This has been fixed in 5.74.3 and 6.24.2.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist / statamic/cms
Introduced in: 0 Fixed in: 5.74.3
Fix composer require statamic/cms:^5.74.3
Packagist / statamic/cms
Introduced in: 6.0.0 Fixed in: 6.24.2
Fix composer require statamic/cms:^6.24.2

References