Contao: Cross-site scripting in the comments bundle
Critical · CVSS 9.3
An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it. No `Content-Security-Policy` header is sent on the Contao back end, so nothing mitigates the inline handler. ### Impact Anyone on the internet can inject script that executes in the Contao back end origin, under the session of whichever user opens the Comments module, with no click and no hover.
Remediation
Upgrade contao/comments-bundle to 5.3.50 or later. Upgrade contao/comments-bundle to 5.7.12 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-628f-v4f6-p37r