{"items":[{"id":"NVI-00001924","kind":"vulnerability","title":"Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6jq6-x4cx-qvcm"],"plain_summary":"OSV carries this publisher advisory for grumpydictator/firefly-iii. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 6.6.3 for grumpydictator/firefly-iii. Confirm the publisher’s latest guidance.","source_ids":["sr-05532314ba610b4d9850d5995bf5e798"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-05532314ba610b4d9850d5995bf5e798","url":"https://github.com/advisories/GHSA-6jq6-x4cx-qvcm","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-6jq6-x4cx-qvcm","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.937Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-05532314ba610b4d9850d5995bf5e798"],"technology":"grumpydictator/firefly-iii","known_exclusions":[],"conditions_summary":"## Summary\n\nThe Twig template `resources/views/list/ale.twig` renders the piggy bank name from `AuditLogEntry.after.piggy` using the `|raw` filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.\n\n## Root Cause\n\nThe `|raw` filter is required on the outer `trans()` call to preserve `` tags in the `amount` parameter (currency styling). However, this also disables escaping for the user-controlled `name` parameter.\n\n**Vulnerable code (`resources/views/list/ale.twig` lines 107, 110):**\n```twig\n{{ trans('firefly.ale_action_log_add', {\n    amount: formatAmountBySymbol(...),\n    name: logEntry.after.piggy\n})|raw }}\n```\n\nNo HTML sanitization at storage time — `PiggyBankStoreRequest` only validates `min:1|max:255|uniquePiggyBankForUser`.\n\n## Data Flow\n\n```\nPOST /api/v1/piggy-banks {\"name\": \"\"}\n  → Stored verbatim in piggy_banks.name\n  → Transaction rule fires add_to_piggy / remove_from_piggy\n  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name\n  → Any user views /transactions/show/{id}\n  → ale.twig outputs unescaped payload","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 6.6.3"]}],"null_published_at":"2026-10-31T21:53:28.058Z","source_updated_at":"2026-09-10T03:51:08.026Z","source_disclosed_at":"2026-06-12T15:04:50.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:59.937Z"}],"next_cursor":null,"snapshot_revision":"42594"}