Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

aimeos/ai-cms-grapesjs

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.6PackagistPublished

    Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors

    CVE-2025-66468 · GHSA-424m-fj2q-g7vg

    Affected
    • Packagist aimeos/ai-cms-grapesjs >= 2021.04.1, < 2021.10.8; >= 2022.04.1, < 2022.10.9; >= 2023.04.1, < 2023.10.15; >= 2024.04.1, < 2024.10.8; >= 2025.04.1, < 2025.10.2
    Fixed in
    2024.10.82022.10.92023.10.152021.10.82025.10.2· Vendor fix available
    Issue
    Impact Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. Workaround If the standard CSP rules are active (default in production mode), an exploit isn't possible. Credits Lwin Min Oo <lwinminoo2244@gmail.com

    Recommended action: Upgrade to 2025.10.2, 2024.10.8, 2023.10.15 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →