GHSA-2xm2-23ff-p8ww: Formie has XSS vulnerability for email notification content for preview

Skip to content

Navigation Menu

• • GitHub Copilot

    Write better code with AI

  • GitHub Advanced Security

    Find and fix vulnerabilities

  • Actions

    Automate any workflow

  • Codespaces

    Instant dev environments

  • Issues

    Plan and track work

  • Code Review

    Manage code changes

  • Discussions

    Collaborate outside of code

  • Code Search

    Find more, search less

• Explore

  • Learning Pathways
  • Events & Webinars
  • Ebooks & Whitepapers
  • Customer Stories
  • Partners
  • Executive Insights

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• • Enterprise platform

    AI-powered developer platform

• Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2025-32426

Formie has XSS vulnerability for email notification content for preview

Moderate severity GitHub Reviewed Published Apr 11, 2025 in verbb/formie • Updated Apr 11, 2025

Package

Affected versions

<= 2.1.43

Description

Impact

It is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered email).

This would require access to the form’s email notification settings.

Patches

This has been fixed in Formie 2.1.44. Users should ensure they are running at least this version.

References

• GHSA-2xm2-23ff-p8ww
• https://nvd.nist.gov/vuln/detail/CVE-2025-32426

Published to the GitHub Advisory Database

Apr 11, 2025

Last updated

Apr 11, 2025

EPSS score