@draadnl/openstad-cms (>=0.12.2, <=0.12.3), apostrophe-personas (>=2.0.0, <=2.2.1) +1 more potentially affected by CVE-2021-25978 via apostrophe (>=2.107.2, <=2.227.12)

apostrophe NPM version =2.107.2, =0.12.2, =2.0.0, =2.2.1 - apostrophe-selective-permissions 2.0.0 Source cves: CVE-2021-25978 Source advisory: OSV:GHSA-4R9C-JGHC-CX5M...

CVE-2021-25978

CVE-2021-25978 affects Apostrophe CMS versions 2.63.0–3.3.1. The flaw is a Stored XSS in the Images module: an editor-uploaded SVG containing malicious JavaScript can trigger XSS when viewed. The connected documents confirm the vulnerability class and affected range but do not provide a remediati...