{"id":"GHSA-jp3q-wwp3-pwv9","summary":"Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue","details":"**Summary**\nAn authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with `dangerouslySetInnerHTML` without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens.\n\n**Affected Product**\n- Ecosystem: Packagist (Craft CMS plugin)\n- Package: solspace/craft-freeform\n- Version: \u003c= 5.14.6 (latest observed). Likely all 5.x until patched.\n\n**Details**\n- Root cause: Multiple user-controlled strings (field labels, section labels, integration icons, short names, WYSIWYG previews) are injected into React components using `dangerouslySetInnerHTML` without sanitization.\n- Evidence: `dangerouslySetInnerHTML` on user-controlled properties in bundled CP JS at [packages/plugin/src/Resources/js/client/client.js](packages/plugin/src/Resources/js/client/client.js#L1).\n\n**PoCs**\n- Label-based XSS:\n  1. In Craft CP, create/edit a Freeform field and set its label to `\u003cimg src=x onerror=\"alert('xss-label')\"\u003e`.\n  2. Open the form builder view containing the field.\n  3. Alert executes (stored XSS).\n- Integration icon SVG:\n  1. Set an integration \"icon SVG\" to `\u003csvg\u003e\u003cscript\u003ealert('xss-icon')\u003c/script\u003e\u003c/svg\u003e`.\n  2. Open the integrations CP view.\n  3. Script executes.\n\n**Impact**\nArbitrary JS in admin CP; session/CSRF token theft; potential full admin takeover via DOM-driven actions.\n\n**Remediation**\n- Sanitize/HTML-encode all user-controlled strings before passing to `dangerouslySetInnerHTML`, or avoid it for labels/titles/icons.\n- Server-side: strip/escape disallowed tags on save for fields, integration metadata, WYSIWYG content.\n- Add regression tests with `\u003cimg onerror\u003e` payloads to ensure no execution in builder/integration views.\n\n**Workarounds**\n- Restrict form-edit permissions to trusted admins only until patched.\n- Consider CSP that disallows inline scripts (defense-in-depth only).\n\n**Credits**\n- Discovered by https://www.linkedin.com/in/praveenkavinda/ | Prav33N-Sec.","aliases":["CVE-2026-26188"],"modified":"2026-02-13T20:01:30.201062Z","published":"2026-01-22T21:41:14Z","database_specific":{"github_reviewed_at":"2026-01-22T21:41:14Z","nvd_published_at":"2026-02-12T23:16:09Z","cwe_ids":["CWE-79"],"severity":"LOW","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/solspace/craft-freeform/security/advisories/GHSA-jp3q-wwp3-pwv9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26188"},{"type":"WEB","url":"https://github.com/solspace/craft-freeform/commit/b9adad6cdf1eba5400aae8b1ae39bd7d4d33af5e"},{"type":"PACKAGE","url":"https://github.com/solspace/craft-freeform"},{"type":"WEB","url":"https://github.com/solspace/craft-freeform/releases/tag/v5.14.7"}],"affected":[{"package":{"name":"solspace/craft-freeform","ecosystem":"Packagist","purl":"pkg:composer/solspace/craft-freeform"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.14.7"}]}],"versions":["5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.14.1","5.0.15","5.0.16","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.6.1","5.0.7","5.0.8","5.0.9","5.1.0","5.1.1","5.1.10","5.1.11","5.1.12","5.1.13","5.1.13.1","5.1.14","5.1.15","5.1.16","5.1.16.1","5.1.17","5.1.18","5.1.18.1","5.1.19","5.1.19.1","5.1.2","5.1.3","5.1.4","5.1.5","5.1.5.1","5.1.6","5.1.7","5.1.8","5.1.9","5.10.0","5.10.1","5.10.10","5.10.11","5.10.12","5.10.13","5.10.14","5.10.15","5.10.15.1","5.10.16","5.10.16.1","5.10.17","5.10.17.1","5.10.2","5.10.3","5.10.4","5.10.5","5.10.6","5.10.7","5.10.8","5.10.9","5.11.0","5.11.1","5.11.10","5.11.11","5.11.12","5.11.13","5.11.14","5.11.16","5.11.17","5.11.2","5.11.3","5.11.4","5.11.5","5.11.6","5.11.7","5.11.8","5.11.9","5.12.0","5.12.1","5.12.2","5.12.3","5.12.4","5.13.0","5.13.1","5.13.2","5.13.3","5.13.4","5.13.5","5.13.6","5.13.7","5.13.8","5.14.0","5.14.1","5.14.2","5.14.3","5.14.4","5.14.5","5.14.6","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.3.2","5.3.3","5.3.3.1","5.3.4","5.3.5","5.4.0","5.4.1","5.4.2","5.5.0","5.5.1","5.5.10","5.5.2","5.5.3","5.5.4","5.5.5","5.5.6","5.5.7","5.5.8","5.5.9","5.6.0","5.6.1","5.6.2","5.6.3","5.6.4","5.6.5","5.6.6","5.6.7","5.6.8","5.7.0","5.7.0.1","5.7.1","5.7.2","5.7.3","5.7.4","5.8.0","5.8.1","5.8.2","5.8.3","5.8.4","5.8.5","5.8.6","5.8.7","5.9.0","5.9.1","5.9.1.1","5.9.1.2","5.9.10","5.9.11","5.9.12","5.9.13","5.9.14","5.9.15","5.9.16","5.9.16.1","5.9.2","5.9.3","5.9.4","5.9.5","5.9.6","5.9.7","5.9.8","5.9.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 5.14.6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-jp3q-wwp3-pwv9/GHSA-jp3q-wwp3-pwv9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P"}]}