{"items":[{"id":"NVI-00004340","kind":"vulnerability","title":"Silverstripe XSS in Director::force_redirect()","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jqp8-v74p-g8px"],"plain_summary":"OSV carries this publisher advisory for silverstripe/framework. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.1.12 for silverstripe/framework. Confirm the publisher’s latest guidance.","source_ids":["sr-62c56b68b14cb717c539117a246a6e0a"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-62c56b68b14cb717c539117a246a6e0a","url":"https://github.com/advisories/GHSA-jqp8-v74p-g8px","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-jqp8-v74p-g8px","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.969Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-62c56b68b14cb717c539117a246a6e0a"],"technology":"silverstripe/framework","known_exclusions":[],"conditions_summary":"A low level XSS vulnerability has been found in the Framework affecting http redirection via the Director::force_redirect method.\n\nAttempts to redirect to a url may generate HTML which is not safely escaped, and may pose a risk of XSS in some environments.\n\nThis vulnerability is marked low as it is difficult to exploit, as any injected HTML will only be returned from the server if the Location HTTP header is also sent, meaning that any user browsing the site would not be exposed to the body of the response before their browser redirects them.","public_affected_ranges":["ECOSYSTEM: introduced 3.1.0; fixed 3.1.12"]}],"null_published_at":"2026-10-31T22:12:52.643Z","source_updated_at":"2024-11-28T05:41:05.029Z","source_disclosed_at":"2024-05-23T16:48:11.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:30.969Z"}],"next_cursor":null,"snapshot_revision":"42594"}