{"items":[{"id":"NVI-00007336","kind":"vulnerability","title":"XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-9jp8-cwwx-p64q"],"plain_summary":"OSV carries this publisher advisory for ezsystems/ezplatform-admin-ui. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.5.25.1 for ezsystems/ezplatform-admin-ui. Confirm the publisher’s latest guidance.","source_ids":["sr-d7d61f578a0d5e25d2526abbcf7c1cc8"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d7d61f578a0d5e25d2526abbcf7c1cc8","url":"https://github.com/advisories/GHSA-9jp8-cwwx-p64q","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-9jp8-cwwx-p64q","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.688Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d7d61f578a0d5e25d2526abbcf7c1cc8"],"technology":"ezsystems/ezplatform-admin-ui","known_exclusions":[],"conditions_summary":"The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.","public_affected_ranges":["ECOSYSTEM: introduced 1.5.0; fixed 1.5.25.1"]}],"null_published_at":"2026-10-31T22:13:14.332Z","source_updated_at":"2024-12-02T05:39:56.175Z","source_disclosed_at":"2021-12-01T18:28:38.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:10.688Z"}],"next_cursor":null,"snapshot_revision":"40769"}