XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | ezsystems/ezplatform-richtext | >= 2.3.0, < 2.3.7.1 | 2.3.7.1 |
References
- https://github.com/ezsystems/ezplatform-richtext/security/advisories/GHSA-fxwm-rx68-p5vx
- https://github.com/ezsystems/ezplatform-richtext/commit/3cebfe2ae4c22e6590632a0ff71893854a16afc5
- https://developers.ibexa.co/security-advisories/ibexa-sa-2021-010-xss-in-richtext-custom-tag-attributes
- https://github.com/ezsystems/ezplatform-richtext
- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
ezsystems/ezplatform-richtext- Disclosed
- 01.12.2021
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-fxwm-rx68-p5vx - CC BY 4.0
Vulnerability history: ezsystems/ezplatform-richtext
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 12.2021 04.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 1
Disclosures per year
- 2021: 1
- 2022: 0
- 2023: 0
- 2024: 1
- 2025: 1
- 2026: 0
-
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.