Low severity2.7NVD Advisory· Published May 28, 2024· Updated Jun 17, 2026
CVE-2024-35239
CVE-2024-35239
Description
Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of the patched versions (13.0.1, 12.2.2, 10.5.3, 8.13.13).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
Umbraco.FormsNuGet | >= 13.0.0, < 13.0.1 | 13.0.1 |
Umbraco.FormsNuGet | >= 12.0.0, < 12.2.2 | 12.2.2 |
Umbraco.FormsNuGet | >= 10.0.0, < 10.5.3 | 10.5.3 |
Umbraco.FormsNuGet | >= 8.0.0, < 8.13.13 | 8.13.13 |
Affected products
3cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:umbraco:umbraco_forms:*:*:*:*:*:*:*:*range: <8.13.13
- (no CPE)range: >= 13.0.0, < 13.0.1
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-p572-p2rj-q5f4ghsaADVISORY
- github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-p572-p2rj-q5f4nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-35239ghsaADVISORY
- docs.umbraco.com/umbraco-forms/developer/configurationnvdProductWEB
- docs.umbraco.com/umbraco-forms/release-notesnvdRelease NotesWEB
- docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notesnvdRelease NotesWEB
- docs.umbraco.com/umbraco-forms/v/10.forms.latest/release-notesghsaWEB
- docs.umbraco.com/umbraco-forms/v/12.forms.latest/release-notesnvdRelease NotesWEB
News mentions
0No linked articles in our index yet.