### Impact
Mautic versions before 3.3.4 / 4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets.

### Patches
Upgrade to 3.3.4 or 4.0.0

### Workarounds
No

### References
https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [[email protected]](mailto:[email protected])

Affected Packages

Packagist mautic/core

Affected versions: 0 (fixed in 3.3.4)

Packagist mautic/core

Affected versions: 4.0.0-alpha1 (fixed in 4.0.0)

Related CVEs

CVE-2021-27912

Key Information

GHSA ID

GHSA-rh5w-82wh-jhr8

Published

September 1, 2021 6:40 PM

Last Modified

August 30, 2021 6:05 PM

CVSS Score

7.5 /10

Primary Ecosystem

Packagist

Primary Package

mautic/core

GitHub Reviewed

✓ Yes

Dataset

Last updated: June 18, 2025 6:25 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.