CVE-2026-27126

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and `allowAdminChanges` must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.

• CWE-79

• https://github.com/craftcms/cms/commit/f5d488d9bb6eff7670ed2c2fe30e15692e92c52bPatch
• https://github.com/craftcms/cms/security/advisories/GHSA-3jh3-prx3-w6wcThird Party Advisory

Published

Feb 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27120Leafkit is a templating language with Swift-inspired syntax.…6.1
• CVE-2026-27121svelte performance oriented web framework. Versions of svelt…5.4
• CVE-2026-27122svelte performance oriented web framework. Prior to 5.51.5, …5.4
• CVE-2026-27123Rejected reason: Reason: This candidate was issued in error.
• CVE-2026-27124FastMCP is the standard framework for building MCP applicati…6.1
• CVE-2026-27125svelte performance oriented web framework. Prior to 5.51.5, …6.8
• CVE-2026-27127Craft is a content management system (CMS). In versions 4.5.…6.3
• CVE-2026-27128Craft is a content management system (CMS). In versions 4.5.…4.8
• CVE-2026-27129Craft is a content management system (CMS). In versions 4.5.…6.5
• CVE-2026-2713IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rap…7.8
• CVE-2026-27130Dokploy is a free, self-hostable Platform as a Service (PaaS…9.9
• CVE-2026-27131The Sprig Plugin for Craft CMS is a reactive Twig component …5.5