Is CVE-2026-55790 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55790 being exploited in the wild.

How severe is CVE-2026-55790?

High severity, with a CVSS score of 4, published 1 July 2026.

Which products and versions are affected?

craftcms/cms (Packagist) ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.9.23.

Is there a fix for CVE-2026-55790?

Yes. craftcms/cms (Packagist): upgrade to 5.9.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55790 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55790?

Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55790: Craft CMS DOM XSS in CraftSupport widget via GitHub issue titles

CVE-2026-55790 · Severity: high · CVSS 4 · Published 2026-07-01

A vulnerability in Craft CMS allows an attacker to execute malicious code in an administrator's browser session. By creating a GitHub issue with a specially crafted title, an attacker can trigger this code when an administrator searches for feedback within the Craft CMS dashboard. This could allow the attacker to perform actions on behalf of the administrator, potentially compromising the website's data or configuration.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-55790 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55790 being exploited in the wild.
How severe is CVE-2026-55790?: High severity, with a CVSS score of 4, published 1 July 2026.
Which products and versions are affected?: craftcms/cms (Packagist) ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.9.23.
Is there a fix for CVE-2026-55790?: Yes. craftcms/cms (Packagist): upgrade to 5.9.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55790 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55790?: Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

craftcms/cms (Packagist): upgrade to 5.9.23 or later
```
composer require craftcms/cms:^5.9.23
```

Technical details

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the CraftSupport widget of Craft CMS. The root cause is the improper handling of GitHub API responses in `CraftSupportWidget.js`, where `result.title` is passed directly to jQuery's `.html()` method without sanitization. Because the GitHub API returns issue titles as raw strings, an attacker can submit a GitHub issue to the `craftcms/cms` repository containing a JavaScript payload (e.g., using `<img>` tags with `onerror` attributes). When an administrator uses the 'Give feedback' search and the malicious issue is returned, the payload executes in the context of the control panel. This allows for session hijacking or performing administrative actions via CSRF token access. The issue is fixed in versions 4.17.16 and 5.9.23.

Affected products

Pixel & Tonic Craft CMS >= 4.0.0-RC1, < 4.17.15; >= 5.0.0-RC1, < 5.9.22

Identifiers

CVE-2026-55790
GHSA-24x4-j6x9-rfw5

Timeline

2026-06-16: disclosed
2026-07-01: advisory: NVD published date
2026-07-06: patched: GitHub Advisory published/updated date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.