CVE-2022-42466 — XSS vulnerability, eg for String properties.
Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value …
Published: 2022-10-19 · CVSS: 6.1 · CVSS 3.1
Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. In particular, the end-user could enter javascript or similar and this would be executed. As of this release, the inputted strings are properly escaped when rendered.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7