AIKIDO-2026-242641

TL;DR

The silverstripe/framework CMS exposes an Insert media from web feature that renders oEmbed results through EmbedShortcodeProvider. When the resolved embed HTML contains two or fewer tags, sandboxHtml returns it directly into the page instead of isolating it in a sandboxed iframe, so the embed markup runs in the context of the main document. An attacker who controls the embed response can include event-handler attributes such as onload or a javascript: or data: iframe source, causing script to execute in a CMS user's browser. The fix strips unknown and dangerous attributes and rejects unsafe URL schemes on non-sandboxed iframes.