plone.app.textfield Stored XSS Vulnerability: Early Warning
An early warning has been issued regarding a stored XSS vulnerability in the plone.app.textfield package, which reportedly allows for the execution of malicious scripts in the viewer's browser under certain conditions.
What happened
An early warning has been issued for a stored XSS vulnerability tracked as GHSA-4R4F-GG25-RMG5 in the plone.app.textfield package. This vulnerability appears to allow for the execution of malicious scripts in the viewer's browser when a RichText field is defined with matching mimeType and outputMimeType values. The affected versions are reportedly plone.app.textfield (pypi) <2.0.2, <3.0.2, and <4.0.1. It is under investigation whether a compromise has occurred. Professional software engineers using this package should assess their exposure by checking their current version against the affected ranges. The recommended action is to upgrade plone.app.textfield to version 4.0.1 or higher, depending on the Plone version in use. For more detailed information, primary sources should be consulted.
How 0Day mitigates this
plone.app.textfield is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.