# CVE-2026-55790: Craft CMS DOM XSS in CraftSupport widget via GitHub issue titles

Source: https://junglewise.ai/threats/cve-2026-55790-craft-cms-dom-xss-in-craftsupport-widget-via-github-issue-titles  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-55790 · Severity: high · CVSS 4 · Published 2026-07-01

A vulnerability in Craft CMS allows an attacker to execute malicious code in an administrator's browser session. By creating a GitHub issue with a specially crafted title, an attacker can trigger this code when an administrator searches for feedback within the Craft CMS dashboard. This could allow the attacker to perform actions on behalf of the administrator, potentially compromising the website's data or configuration.

Technologies: [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-55790 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55790 being exploited in the wild.

**How severe is CVE-2026-55790?** High severity, with a CVSS score of 4, published 1 July 2026.

**Which products and versions are affected?** craftcms/cms (Packagist) ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.9.23.

**Is there a fix for CVE-2026-55790?** Yes. craftcms/cms (Packagist): upgrade to 5.9.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55790 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55790?** Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- craftcms/cms (Packagist): upgrade to 5.9.23 or later

  ```sh
  composer require craftcms/cms:^5.9.23
  ```


## Technical details

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the CraftSupport widget of Craft CMS. The root cause is the improper handling of GitHub API responses in `CraftSupportWidget.js`, where `result.title` is passed directly to jQuery's `.html()` method without sanitization. Because the GitHub API returns issue titles as raw strings, an attacker can submit a GitHub issue to the `craftcms/cms` repository containing a JavaScript payload (e.g., using `<img>` tags with `onerror` attributes). When an administrator uses the 'Give feedback' search and the malicious issue is returned, the payload executes in the context of the control panel. This allows for session hijacking or performing administrative actions via CSRF token access. The issue is fixed in versions 4.17.16 and 5.9.23.

## Affected products

- Pixel & Tonic Craft CMS >= 4.0.0-RC1, < 4.17.15; >= 5.0.0-RC1, < 5.9.22

## Identifiers

- CVE-2026-55790
- GHSA-24x4-j6x9-rfw5

## Timeline

- 2026-06-16: disclosed
- 2026-07-01: advisory: NVD published date
- 2026-07-06: patched: GitHub Advisory published/updated date

## References

- [https://api.github.com/users/Crypto-Cat](https://api.github.com/users/Crypto-Cat)
- [https://github.com/Crypto-Cat](https://github.com/Crypto-Cat)
- [https://api.github.com/users/Crypto-Cat/gists%7B/gist_id%7D](https://api.github.com/users/Crypto-Cat/gists%7B/gist_id%7D)
- [https://api.github.com/users/Crypto-Cat/repos](https://api.github.com/users/Crypto-Cat/repos)
- [https://avatars.githubusercontent.com/u/12751872?v=4](https://avatars.githubusercontent.com/u/12751872?v=4)
- [https://api.github.com/users/Crypto-Cat/events%7B/privacy%7D](https://api.github.com/users/Crypto-Cat/events%7B/privacy%7D)

## Related threats

- [Craft CMS: Stored XSS in the control panel via unescaped draft name](https://junglewise.ai/threats/cve-2026-72787-craft-cms-stored-xss-in-the-control-panel-via-unescaped-draft)
- [Craft CMS: Arbitrary user password reset leading to administrator account takeover](https://junglewise.ai/threats/cve-2026-72786-craft-cms-arbitrary-user-password-reset-leading-to-administrator)
- [Craft CMS authorization bypass in category structure modification](https://junglewise.ai/threats/craft-cms-authorization-bypass-in-category-structure-modification-1555f980)
- [Craft CMS authenticated RCE through Twig sandbox escape](https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1)
- [Craft CMS path traversal in ensurePathIsContained](https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058)