CVE-2026-55790 Patch Review: Root-Cause Fix for Craft CMS Support Widget DOM XSS

Vulnerability

CVE-2026-55790 describes an unauthenticated DOM-based cross-site scripting issue in the Craft CMS Support Widget. The issue is summarized as untrusted GitHub API issue titles being rendered into the widget DOM, allowing attacker-controlled markup or script-bearing payloads to execute in the browser if inserted through an unsafe HTML sink. The CVE context is corroborated by the CVE record, and the vendor changelog marks it as a high-severity XSS fixed under GHSA-24x4-j6x9-rfw5 in the commit 6bbb66038a268552180ca5c8eed9f46ea25a4417.

From the supplied evidence, the vulnerable surface is the browser-side support widget bundle at src/web/assets/craftsupport/dist/CraftSupportWidget.js. Because the tainted data source is a third-party API response and the bug class is DOM XSS, the likely root cause is direct insertion of issue-title strings into HTML-generating code without output encoding or safe text-node insertion. This is a classic trust-boundary failure: externally sourced metadata was treated as display-safe markup.

## Unreleased

- Fixed a high-severity XSS vulnerability. (GHSA-24x4-j6x9-rfw5)

Patch

The patch is referenced by the upstream commit 6bbb66038a268552180ca5c8eed9f46ea25a4417 and updates the compiled support widget asset plus the changelog. The provided diff excerpt confirms that the vulnerable code path was in the distributed JavaScript bundle, which is important because this is the code actually executed by browsers. Although the excerpt is truncated and does not expose the exact changed sink, the patch summary states the vulnerability was fixed in versions 4.17.16 and 5.9.23, consistent with a client-side remediation in the widget rendering path.

Given the vulnerability description, the effective remediation pattern would be one of the following: replacing HTML insertion with text insertion, escaping issue titles before interpolation, or constructing DOM nodes with safe text content APIs. Any of those would directly neutralize script execution from malicious issue titles. Since the issue is specifically tied to untrusted GitHub API titles, a correct fix must ensure those titles are never interpreted as HTML by the browser.

file: src/web/assets/craftsupport/dist/CraftSupportWidget.js
[VULNERABLE]
... client-side support widget bundle ...

[PATCHED]
... client-side support widget bundle updated in commit 6bbb66038a268552180ca5c8eed9f46ea25a4417 ...

The patch location and advisory framing indicate the remediation was applied where the unsafe DOM write occurred, rather than only adding perimeter checks elsewhere. That is the right layer for a DOM XSS fix.

Review

Pros

• The fix is applied in the browser-executed widget asset, which is the correct enforcement point for a DOM-based XSS issue.
• The vulnerability description ties the exploitability to a specific tainted field, untrusted GitHub issue titles, suggesting the patch scope is concrete rather than generic.
• Updating the distributed bundle reduces the risk of downstream deployments continuing to ship stale vulnerable frontend code.
• The changelog explicitly calls out a high-severity XSS fix, improving operator visibility for upgrade prioritization.

Cons

• The provided diff excerpt is truncated, so the exact sink transformation cannot be independently verified from the supplied material alone.
• The patch appears in a minified or compiled asset, which makes security review and regression auditing harder than reviewing the original source module.
• No explicit tests, sanitizer helper references, or defense-in-depth changes are visible in the supplied snippets.
• If other widget fields from the same API are rendered through similar HTML sinks, the supplied evidence does not prove a broader audit occurred.

Verdict

Root-cause.

Based on the available sources, this patch most likely fixes the actual trust-boundary violation: untrusted remote issue-title content being rendered into the DOM as HTML. The remediation is source-grounded by the CVE description, the NVD and CVE records, and the upstream commit that updates the support widget bundle and changelog. While the truncated compiled diff prevents line-by-line confirmation of the exact API substitution, the patch target and vulnerability mechanics align with a direct sink-level correction rather than a superficial workaround. Engineers should still verify that all externally sourced widget fields use safe text rendering and add regression tests around malicious title payloads.

References: upstream patch commit, NVD CVE entry, CVE record, related report context.