MEDIUM4.5

GHSA-p632-58pp-c9xg

moonshine Stored Cross-Site Scripting Vulnerability in Create Article

Quick fix

GHSA-p632-58pp-c9xg — moonshine/moonshine: upgrade to the fixed version with the command below.

composer require moonshine/moonshine:^3.12.4

Details

A stored cross-site scripting (XSS) vulnerability in the Create Article function of MoonShine v3.12.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Link parameter.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/moonshine/moonshine

Introduced in: 0Fixed in: 3.12.4

Fixcomposer require moonshine/moonshine:^3.12.4

References

https://nvd.nist.gov/vuln/detail/CVE-2025-51487[ADVISORY]
https://github.com/moonshine-software/moonshine/commit/f108f4ea5c0d66e8172c2dc397c1d9a6f466d9c6[WEB]
https://github.com/GiacoLenzo2109/MoonShine_Software_PoCs[WEB]
https://github.com/moonshine-software/moonshine[PACKAGE]