CVE-2024-37161: MeterSphere front-end editor stores XSS vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-06-11 · updated 2026-06-17
Weakness: CWE-79

Description

MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting vulnerabilities. Version 1.10.1-lts fixes this issue.

Affected products

metersphere: before 1.10.1 — fixed in 1.10.1

How to fix

Upgrade to a fixed version: metersphere 1.10.1. Check the vendor advisory for mitigations.

References

https://github.com/metersphere/metersphere/security/advisories/GHSA-6h7v-q5rp-h6q9
https://github.com/metersphere/metersphere/security/advisories/GHSA-6h7v-q5rp-h6q9

Get alerted when CVE-2024-37161 or the next vulnerability affects your stack