| Package | Affected versions | Patched versions |
|---|---|---|
| oro/commerce | ≥ 5.0, < 5.0.4 | 5.0.4 |
Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager
Update GrapeJS dependency to >=v0.19.5
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free