CVE-2024-23725: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

January 21, 2024 (updated January 22, 2024)

Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.

References

github.com/TryGhost/Ghost/pull/17190
github.com/TryGhost/Ghost/releases/tag/v5.76.0
github.com/advisories/GHSA-fh38-9fgr-454w
github.com/yunaycompany/Ghost/commit/64d67717f7c76c77b3908e15627f473e9ef34002
nvd.nist.gov/vuln/detail/CVE-2024-23725

Code Behaviors & Features

Detect and mitigate CVE-2024-23725 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →