CVE-2026-33883: Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag

March 26, 2026 (updated March 27, 2026)

The user:reset_password_form tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim’s browser.

References

github.com/advisories/GHSA-3jg4-p23x-p4qx
github.com/statamic/cms
github.com/statamic/cms/security/advisories/GHSA-3jg4-p23x-p4qx
nvd.nist.gov/vuln/detail/CVE-2026-33883

Code Behaviors & Features

Detect and mitigate CVE-2026-33883 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →