Kirby cross-site scripting (XSS) in the link field "Custom" type
Description
Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any of the pre-defined link formats. As the "Custom" link type is meant to be flexible, it also allows the javascript: URL scheme. In some use cases this can be intended, but it can also be misused by attackers to execute arbitrary JavaScript code when a user or visitor clicks on a link that is generated from the contents of the link field. This vulnerability is patched in 4.1.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
getkirby/cmsPackagist | >= 4.0.0, < 4.1.1 | 4.1.1 |
Affected products
1Patches
1cda3dd9a1522Link field: Don’t allow custom type by default
2 files changed · +2 −4
config/fields/link.php+1 −2 modified@@ -22,8 +22,7 @@ 'file', 'email', 'tel', - 'anchor', - 'custom' + 'anchor' ]; }, 'value' => function (string|null $value = null) {
tests/Form/Fields/LinkFieldTest.php+1 −2 modified@@ -26,8 +26,7 @@ public function testDefaultProps() 'file', 'email', 'tel', - 'anchor', - 'custom' + 'anchor' ], $field->options()); } }
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-63h4-w25c-3qv4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-27087ghsaADVISORY
- github.com/getkirby/kirby/commit/cda3dd9a15228d35e62ff86cfa87a67e7c687437ghsax_refsource_MISCWEB
- github.com/getkirby/kirby/releases/tag/4.1.1ghsaWEB
- github.com/getkirby/kirby/security/advisories/GHSA-63h4-w25c-3qv4ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.