Skip to content

[GHSA-hcch-w73c-jp4m] Statamic vulnerable to privilege escalation via stored cross-site scripting #7383

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Shirshaw64p wants to merge 1 commit into from
+1 −1
Closed

[GHSA-hcch-w73c-jp4m] Statamic vulnerable to privilege escalation via stored cross-site scripting #7383

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion advisories/github-reviewed/2026/03/GHSA-hcch-w73c-jp4m/GHSA-hcch-w73c-jp4m.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"CVE-2026-32612"
],
"summary": "Statamic vulnerable to privilege escalation via stored cross-site scripting",
"details": "### Impact\n\nStored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account.\n\n### Patches\n\nThis has been fixed in 6.6.2.",
"details": "### Impact\n\nStored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account.\n\n### Patches\n\nThis has been fixed in 6.6.2.\n\n### Credits\nShirsendu Mondal - UNC Pembroke",
Copy link

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description asks to add “Shirsendu Mondal (@Shirshaw64p)”, but the added credits line does not include the GitHub handle and instead includes an affiliation (“UNC Pembroke”). Update the credits line to match the requested attribution (or update the PR description if the intended credit text is different).

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Embedding credits only inside the free-form details markdown can make attribution harder to query/standardize across advisories. If this repository’s advisory schema supports structured attribution (for example, a dedicated credits/acknowledgements field used in other advisories), prefer adding the credit there and keep details focused on impact/patch guidance.

Suggested change
"details": "### Impact\n\nStored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account.\n\n### Patches\n\nThis has been fixed in 6.6.2.\n\n### Credits\nShirsendu Mondal - UNC Pembroke",
"details": "### Impact\n\nStored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account.\n\n### Patches\n\nThis has been fixed in 6.6.2.",
"credits": [
{
"name": "Shirsendu Mondal",
"contact": [
"UNC Pembroke"
]
}
],

Copilot uses AI. Check for mistakes.
"severity": [
{
"type": "CVSS_V3",
Expand Down
Loading