CVE-2021-3841: Stored Cross-site Scripting (XSS) in sylius/sylius

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-15 · updated 2026-06-17
Weakness: CWE-79

Description

sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser.

Affected products

Sylius: before 1.9.10; from 1.10.0 before 1.10.11; from 1.11.0 before 1.11.2 — fixed in 1.10.11, 1.11.2, 1.9.10

How to fix

Upgrade to a fixed version: Sylius 1.10.11, 1.11.2, 1.9.10. Check the vendor advisory for mitigations.

References

https://github.com/sylius/sylius/commit/3da169e0c23e752974d74223cc536c29a2a82edc
https://huntr.com/bounties/1625506791178-Sylius/Sylius

Get alerted when CVE-2021-3841 or the next vulnerability affects your stack