MEDIUM6.1

GHSA-pq95-94c9-j987

yaffa vulnerable to Cross Site Scripting

Details

yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/kantorge/yaffa

Introduced in: 0

No fixed version published yet for kantorge/yaffa (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-70844[ADVISORY]
https://github.com/J4cky1028/vulnerability-research/tree/main/CVE-2025-70844[WEB]
https://github.com/kantorge/yaffa[PACKAGE]