Impact

Cross-Site Scripting (XSS) vulnerability was found in API\ResponseTrait in Codeigniter4.
Attackers can do XSS attacks if you are using API\ResponseTrait.

Patches

Upgrade to v4.1.8 or later.

Workarounds

Do one of the following:

1. Do not use API\ResponseTrait nor ResourceController
2. Disable Auto Route and Use Defined Routes Only

References

• Cross Site Scripting (XSS) Software Attack | OWASP Foundation

For more information

If you have any questions or comments about this advisory:

• Open an issue in codeigniter4/CodeIgniter4
• Email us at SECURITY.md