Sveltia CMS stored XSS in entry summary rendering

Executive brief

Sveltia CMS, a content management system, is vulnerable to a security flaw where malicious code can be embedded in entry summaries. If an attacker can place specially crafted content into the repository, it could execute unauthorized scripts in the browser of a user viewing the entry list. While the risk is currently low because the system is typically used by small, trusted teams, it could lead to unauthorized actions being performed on behalf of a user.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Sveltia CMS due to an incorrect processing order during entry summary rendering. The system parsed and sanitized Markdown-enabled summaries before decoding HTML entities, allowing attackers to bypass sanitization using entity-encoded HTML tags or event handlers. An attacker with write access to the content repository can inject malicious payloads that execute arbitrary JavaScript in the context of other users' browsers when they view entry lists or search results. The issue is fixed in version 0.160.1 by ensuring HTML entity decoding occurs before the sanitization step.

Affected products

• Sveltia @sveltia/cms < 0.160.1

Timeline

• 2026-05-11: patched: Version 0.160.1 released
• 2026-05-18: advisory: GitHub Advisory GHSA-97r8-rf7q-wmjw published

References

• https://api.github.com/users/blacksolo1
• https://github.com/blacksolo1
• https://api.github.com/users/blacksolo1/gists%7B/gist_id%7D
• https://api.github.com/users/blacksolo1/repos
• https://avatars.githubusercontent.com/u/89329191?v=4
• https://api.github.com/users/blacksolo1/events%7B/privacy%7D