Cross-site scripting in CodeIgniter4 - #VU155852
Published: October 15, 2026
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript in a visitor's browser under the application's origin.
The vulnerability exists due to improper neutralization of input during web page generation in the View Parser when processing sequential substitutions containing attacker-controlled parser syntax. A remote attacker can supply an escaping-bypass placeholder that references another attacker-controlled value substituted later to execute arbitrary JavaScript in a visitor's browser under the application's origin.
Exploitation depends on the template structure and substitution order but does not require control of the template itself. A visitor must view the affected rendered content. Default HTML escaping and explicitly configured HTML escaping do not prevent exploitation.