Executive brief
Sveltia CMS is a lightweight content management system used by developers and small teams to manage website content. A stored cross-site scripting (XSS) vulnerability in entry summary rendering allows attackers with write access to inject malicious JavaScript code that executes in the browsers of users viewing entry lists or search results. While the impact is reduced because Sveltia CMS is designed for trusted single-developer or small-team environments, successful exploitation could compromise user sessions or steal sensitive data.
Technical details
This is a stored XSS vulnerability (CWE-79) affecting entry summary rendering in Sveltia CMS when Markdown support is enabled. The root cause is incorrect order of operations: entry summaries were first parsed and sanitized, then HTML entities were decoded afterward. This allows attackers to craft entity-encoded HTML payloads (e.g., <script> or event handlers) that bypass the sanitizer and become active HTML after decoding. Exploitation requires write access to the repository or content source loaded by the CMS. The vulnerability has been patched in v0.160.1 by performing HTML entity decoding before sanitization, ensuring all decoded HTML is processed by the sanitizer.
Affected products
- Sveltia CMS <0.160.1
Timeline
- 2026-05-18: disclosed: Advisory GHSA-97r8-rf7q-wmjw published
- 2026-05-18: patched: Fix released in v0.160.1