GHSA-v73w-r9xg-7cr9: 
PHP vulnerability analysis and mitigation

A moderate severity vulnerability (GHSA-v73w-r9xg-7cr9) was identified in OctoberCMS affecting versions 1.0.319 through 1.0.466. The vulnerability stems from the use of an insecure jQuery version (3.4.0) that could potentially lead to code execution through DOM manipulation methods. The issue was discovered and reported by mrgswift to the October CMS team, and was published on June 2, 2020 (GitHub Advisory).

The vulnerability exists in jQuery versions greater than or equal to 1.2 and before 3.5.0, where passing HTML from untrusted sources - even after sanitizing it - to jQuery's DOM manipulation methods (such as .html(), .append(), and others) could lead to execution of untrusted code. The issue was assigned a moderate severity rating by the jQuery team (GitHub Issue).

The primary impact of this vulnerability is the potential execution of untrusted code through jQuery's DOM manipulation methods, even when the HTML input has been sanitized. This could lead to cross-site scripting (XSS) attacks in applications using the affected versions of OctoberCMS (GitHub Advisory).

The vulnerability can be exploited by passing specially crafted HTML from untrusted sources to jQuery's DOM manipulation methods. The issue affects all OctoberCMS installations using versions between 1.0.319 and 1.0.466 that haven't applied the necessary patches (GitHub Advisory).

The vulnerability has been patched in OctoberCMS Build 466 (v1.0.466) by applying the recommended patch from jQuery. For users unable to upgrade to Build 466, a manual workaround is available by applying the patch from commit 5c7ba9f to their installation. Alternatively, users can override jQuery.htmlPrefilter as a temporary solution (GitHub Issue, GitHub Commit).