CVE-2026-25133: October Rain has Stored XSS via SVG Filter Bypass

April 14, 2026 (updated June 16, 2026)

A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.

References

github.com/advisories/GHSA-gcqv-f29m-67gr
github.com/octobercms/october/security/advisories/GHSA-gcqv-f29m-67gr
nvd.nist.gov/vuln/detail/CVE-2026-25133

Code Behaviors & Features

Detect and mitigate CVE-2026-25133 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →