AIKIDO-2026-348054
bolt/core is vulnerable to Cross-Site Scripting (XSS)
50
Medium Risk
This Affects:
bolt/coreTL;DR
The editor's ajax save handler renders toast notifications and validation feedback by inserting message content, including the record title and validator messages, as HTML. Because these values are user-controlled content, saving a record with markup in a title or in a field that fails validation causes script to execute in the backend when the toast is shown. This results in stored cross-site scripting within the administration interface. The fix renders the toast body as text so message content is no longer interpreted as markup.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you have backend users with content-edit access whose input can be rendered back in the editor interface.
Background info
bolt/core is vulnerable to Cross-Site Scripting (XSS) in versions 5.2.0 - 6.1.6.
How to fix this
Upgrade the bolt/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant