plankanban/planka v1.26.3

on GitHub

Security Release

• Fixed a vulnerability where maliciously renamed file attachments could execute JavaScript in the gallery UI.
• The issue originated from an upstream library react-photoswipe-gallery, but PLANKA has patched it locally to prevent the use of dangerous innerHTML when setting gallery captions.
• Users should update to PLANKA >= 1.26.3 or >= 2.0.0-rc.4 to be protected.
• More details and credits: Security Advisory
• Reported by @AmjadAlii via responsible disclosure.

What's Changed

• fix: Patch react-photoswipe-gallery to prevent XSS in captions

Full Changelog: v1.26.2...v1.26.3