AIKIDO-2026-30760

aimeos/ai-client-html is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-47pc-vv2q-q749 Published Yesterday

Medium Risk

This Affects:

aimeos/ai-client-html

2022.04.1 - 2022.10.16

Fixed in 2022.10.17

2023.04.1 - 2023.10.22

Fixed in 2023.10.23

2024.04.1 - 2024.10.10

Fixed in 2024.10.11

2025.04.1 - 2025.10.7

Fixed in 2025.10.8

2026.04.1 - 2026.04.4

Fixed in 2026.04.5

Are you affected? Scan for Free

TL;DR

The storefront passes item names and labels for categories, products, suppliers, and attributes, along with CMS and product text, through the TRUST escaper flag, so they are not HTML escaped. An editor controlled name or label containing HTML or JavaScript runs in the browser of anyone who views category breadcrumbs, product listings, or facet filters. The CMS text save path writes unsanitized text that page templates echo raw, and the storefront sets no Content Security Policy to contain the injected script. The fix removes the TRUST flag so these values are HTML escaped before output.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

aimeos/ai-client-html is vulnerable to Cross-Site Scripting (XSS) in versions 2022.04.1 - 2022.10.16, 2023.04.1 - 2023.10.22, 2024.04.1 - 2024.10.10, 2025.04.1 - 2025.10.7 and 2026.04.1 - 2026.04.4.