AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
High · fetched 2026-10-30
## Summary AdminNeo inserts the database server's version string into a `<script>` tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes arbitrary code. Because the script tag already has a valid nonce, the browser's Content Security Policy does not block execution. No authentication is required when combined with Login CSRF.
Remediation
Upgrade adminneo-org/adminneo to 5.5.1 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-30T20:20:13-04:00 · https://github.com/advisories/GHSA-rx7m-wxwq-vxr9