medium4.1
CVE-2021-3841
Cross site scripting in sylius/sylius
Impact
sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | sylius/sylius | < 1.9.10 | 1.9.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sylius | Sylius | before 1.9.10 from 1.10.0 before 1.10.11 from 1.11.0 before 1.11.2 |