What is the CVSS score of CVE-2026-31833?

CVE-2026-31833 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Umbraco Cms are affected by CVE-2026-31833?

Organizations using Umbraco should be aware of notable risk from CVE-2026-31833, a cross-site scripting vulnerability rated CVSS 6.7.. A patch is available.

How to fix or mitigate CVE-2026-31833?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Umbraco Cms CVE-2026-31833

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-10 security-advisories@github.com

GHSA-vrqc-59mw-qqg7

XSS Umbraco Cms

6.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.7 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 22:16 nvd

MEDIUM 6.7

DescriptionGitHub Advisory

Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.

AnalysisAI

Umbraco is an ASP.NET CMS. From 16.2.0 to versions up to 16.5.1 is affected by cross-site scripting (xss) (CVSS 6.7).

Technical ContextAI

This vulnerability (CWE-79: Cross-site Scripting (XSS)) exists in the Umbraco web component. Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-*, uui-*, ufm-*) were not filtered. This vulnerability is fixed in 16.5.1 and 17.2.2.

RemediationAI

Fixed in version 16.5.1. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.