Headline
GHSA-p9hh-mh5x-wvx3: Formie has XSS vulnerability for importing forms
Impact
When importing a form from JSON, if the field label or handle contained malicious content, the output wasn’t correctly escaped when viewing a preview of what was to be imported.
As imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export.
Patches
This has been fixed in Formie 2.1.44. Users should ensure they are running at least this version.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2025-32427
Formie has XSS vulnerability for importing forms
Moderate severity GitHub Reviewed Published Apr 11, 2025 in verbb/formie • Updated Apr 11, 2025
Package
Affected versions
<= 2.1.43
Impact
When importing a form from JSON, if the field label or handle contained malicious content, the output wasn’t correctly escaped when viewing a preview of what was to be imported.
As imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export.
Patches
This has been fixed in Formie 2.1.44. Users should ensure they are running at least this version.
References
- GHSA-p9hh-mh5x-wvx3
- https://nvd.nist.gov/vuln/detail/CVE-2025-32427
Published to the GitHub Advisory Database
Apr 11, 2025
Last updated
Apr 11, 2025