CVE-2026-56383

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.

• CWE-79

• https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a
• https://github.com/craftcms/cms/security/advisories/GHSA-6j87-m5qx-9fqp
• https://www.vulncheck.com/advisories/craft-cms-stored-xss-in-table-field-via-row-heading-column-type
• https://github.com/craftcms/cms/security/advisories/GHSA-6j87-m5qx-9fqp

Published

Jun 21, 2026

Last Modified

Jun 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56377ImageMagick before 7.1.2-24 contains an incorrect policy che…4.8
• CVE-2026-56378ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) conta…8.2
• CVE-2026-56379ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command…9.2
• CVE-2026-5638A vulnerability was detected in HerikLyma CPPWebFramework up…5.5
• CVE-2026-56381Craft CMS from version 5.0.0-RC1 contains a stored cross-sit…4.8
• CVE-2026-56382Craft CMS (composer package craftcms/cms) versions >= 5.5.0 …8.6
• CVE-2026-56384Craft CMS contains a missing authorization vulnerability in …5.3
• CVE-2026-56385Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1,…5.3
• CVE-2026-56389GNU Bison allows for an execution of an arbitrary program du…6.8
• CVE-2026-5639A flaw has been found in PHPGurukul Online Shopping Portal P…6.3
• CVE-2026-56390GNU Bison improperly handles grammar‑defined output paths. G…4.6
• CVE-2026-56391GNU coreutils uniq is vulnerable to an out‑of‑bounds read du…4.6