Sveltia CMS stored XSS in Markdown preview renderer

Executive brief

Sveltia CMS, a content management system, contains a vulnerability in how it previews Markdown and RichText content. An attacker with the ability to edit content could embed a malicious frame that takes control of the CMS interface when viewed by another user. This could allow the attacker to read or modify sensitive data within the CMS, though the risk is currently low as the software is typically used by small, trusted teams.

Technical details

A stored XSS vulnerability exists in the Markdown/RichText field preview renderer of Sveltia CMS. The DOMPurify configuration allowed `iframe` elements without enforcing a `sandbox` attribute or restricting sources. An attacker can embed an iframe pointing to a same-origin HTML asset; because of the browser's same-origin policy, JavaScript within that iframe can access the parent CMS window's DOM, state, and storage. Exploitation requires the ability to commit malicious content to the repository or content source. The issue is fixed in v0.167.3 by implementing a two-pass sanitization pipeline that enforces HTTPS-only cross-origin sources and mandatory sandboxing for all iframes.

Affected products

• Sveltia Sveltia CMS < 0.167.3

Timeline

• 2026-06-18: disclosed
• 2026-06-19: advisory: GHSA-h5jc-78hr-3pc9 published
• 2026-06-19: patched: Fixed in version 0.167.3

References

• https://api.github.com/users/blacksolo1
• https://github.com/blacksolo1
• https://api.github.com/users/blacksolo1/gists%7B/gist_id%7D
• https://api.github.com/users/blacksolo1/repos
• https://avatars.githubusercontent.com/u/89329191?v=4
• https://api.github.com/users/blacksolo1/events%7B/privacy%7D