CVE-2025-61674: October CMS Vulnerable to Stored XSS via Editor and Branding Styles

January 9, 2026 (updated January 11, 2026)

A cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms:

Editor Settings Markup Styles A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Settings → Editor Settings → Markup Styles.

A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users.

References

github.com/advisories/GHSA-gxxc-m74c-f48x
github.com/octobercms/october
github.com/octobercms/october/security/advisories/GHSA-gxxc-m74c-f48x
nvd.nist.gov/vuln/detail/CVE-2025-61674

Code Behaviors & Features

Detect and mitigate CVE-2025-61674 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →