https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:52:02 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-77850 <p>Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator&#39;s browser.</p> <p>The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in &lt;b&gt; tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record&#39;s label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as &lt;img src=x onerror=...&gt; runs as JavaScript in the admin&#39;s session as soon as a matching record appears in the dropdown, giving the attacker the admin&#39;s privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.</p> <p>This issue affects ash_admin: from 0.13.0 before 1.3.1.</p> <p>Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator&#39;s browser.</p> <p>The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in &lt;b&gt; tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record&#39;s label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as &lt;img src=x onerror=...&gt; runs as JavaScript in the admin&#39;s session as soon as a matching record appears in the dropdown, giving the attacker the admin&#39;s privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.</p> <p>This issue affects ash_admin: from 0.13.0 before 1.3.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-77850