DevDojo Voyager vulnerable to reflected Cross-site Scripting

LOW 3.5CVE-2024-55416 · GHSA-mm49-4f2g-c3wf · Published 30/01/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
tcg/voyager Packagist	`≤ 1.8.0`	No fix yet
voyager thecontrolgroup	`≤ 1.8.0`	No fix yet

Description

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed.

NVD description

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed.

References

nvd.nist.gov/vuln/detail/CVE-2024-55416 · ADVISORY
thedevdojo/voyager · PACKAGE
thedevdojo/voyager · WEB
thedevdojo/voyager · WEB
sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities · WEB
sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free