Medium severity4.8NVD Advisory· Published Jan 13, 2022· Updated Jun 17, 2026

CVE-2022-22125

Description

In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Halo Dev/Halo3 versions
cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*range: >=1.0.0,<=1.4.17
- (no CPE)range: v1.0.0 to v1.4.17
- (no CPE)range: v1.0.0

Patches

Vulnerability mechanics

References

github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.javanvdExploitThird Party Advisory
www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22125nvdExploitThird Party Advisory
github.com/halo-dev/halo/issues/1557nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000