CVE-2023-46252

Squidex is an open source headless CMS and content management hub. Affected versions are missing origin verification in a postMessage handler which introduces a Cross-Site Scripting (XSS) vulnerability. The editor-sdk.js file defines three different class-like functions, which employ a global message event listener: SquidexSidebar, SquidexWidget, and SquidexFormField. The registered event listener takes some action based on the type of the received message. For example, when the SquidexFormField receives a message with the type valueChanged, the value property is updated. The SquidexFormField class is for example used in the editor-editorjs.html file, which can be accessed via the public wwwroot folder. It uses the onValueChanged method to register a callback function, which passes the value provided from the message event to the editor.render. Passing an attacker-controlled value to this function introduces a Cross-Site Scripting (XSS) vulnerability.

• CWE-79

• https://github.com/Squidex/squidex/security/advisories/GHSA-7q4f-fprr-5jw8Exploit, Vendor Advisory
• https://github.com/Squidex/squidex/security/advisories/GHSA-7q4f-fprr-5jw8Exploit, Vendor Advisory

Published

Nov 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46247Vyper is a Pythonic Smart Contract Language for the Ethereum…7.5
• CVE-2023-46248Cody is an artificial intelligence (AI) coding assistant. Th…8.8
• CVE-2023-46249authentik is an open-source Identity Provider. Prior to vers…9.8
• CVE-2023-4625Improper Restriction of Excessive Authentication Attempts vu…5.3
• CVE-2023-46250pypdf is a free and open-source pure-python PDF library. An …5.5
• CVE-2023-46251 MyBB is a free and open source forum software. Custom MyCod…6.1
• CVE-2023-46253Squidex is an open source headless CMS and content managemen…7.2
• CVE-2023-46254capsule-proxy is a reverse proxy for Capsule kubernetes mult…4.3
• CVE-2023-46255SpiceDB is an open source, Google Zanzibar-inspired database…6.5
• CVE-2023-46256PX4-Autopilot provides PX4 flight control solution for drone…9.8
• CVE-2023-46257An attacker sending specially crafted data packets to the Mo…9.8
• CVE-2023-46258An attacker sending specially crafted data packets to the Mo…9.8