{"data":{"id":"magento2-38804","source":"github-pr","sourceRef":"magento/magento2#38804","title":"Update js.phtml DOM text reinterpreted as HTML","pr":{"number":38804,"url":"https://github.com/magento/magento2/pull/38804","author":"Shivam7-1","mergedAt":"2026-06-16T10:43:53Z","mergeCommit":"5c3907190c0a3ea4375f15fad4da707c3ef67893","headCommit":"0335a3de1ca4a34a45096a53b862690b12a31d6e","baseRef":"2.4-develop","diffSha256":"2572cdb5cd8d529b5c7f9dc0c9f064d3bfa025cb9de7462bd4f24208123e25e2"},"issues":[{"number":38821,"url":"https://github.com/magento/magento2/issues/38821","title":"[Issue] Update js.phtml DOM text reinterpreted as HTML","labels":["Area: Security","Component: Backend","Issue: Confirmed","Issue: ready for confirmation","Priority: P2","Progress: PR Created","Progress: PR in progress","Progress: done","Reported on 2.4.x","Reproduced on 2.4.x","Triage: Dev.Experience"],"kind":"pr-derived"}],"fixedIn":null,"containingTags":[],"reportedOn":null,"codeMatch":{"2.4.6":"clean","2.4.6-p1":"clean","2.4.6-p2":"clean","2.4.6-p3":"clean","2.4.6-p4":"clean","2.4.6-p5":"clean","2.4.6-p6":"clean","2.4.6-p7":"clean","2.4.6-p8":"clean","2.4.6-p9":"clean","2.4.6-p10":"clean","2.4.6-p11":"clean","2.4.6-p12":"clean","2.4.6-p13":"clean","2.4.6-p14":"clean","2.4.6-p15":"clean","2.4.7":"clean","2.4.7-p1":"clean","2.4.7-p2":"clean","2.4.7-p3":"clean","2.4.7-p4":"clean","2.4.7-p5":"clean","2.4.7-p6":"clean","2.4.7-p7":"clean","2.4.7-p8":"clean","2.4.7-p9":"clean","2.4.7-p10":"clean","2.4.8":"clean","2.4.8-p1":"clean","2.4.8-p2":"clean","2.4.8-p3":"clean","2.4.8-p4":"clean","2.4.8-p5":"clean","2.4.9":"clean"},"affectedVersions":["2.4.6","2.4.6-p1","2.4.6-p2","2.4.6-p3","2.4.6-p4","2.4.6-p5","2.4.6-p6","2.4.6-p7","2.4.6-p8","2.4.6-p9","2.4.6-p10","2.4.6-p11","2.4.6-p12","2.4.6-p13","2.4.6-p14","2.4.6-p15","2.4.7","2.4.7-p1","2.4.7-p2","2.4.7-p3","2.4.7-p4","2.4.7-p5","2.4.7-p6","2.4.7-p7","2.4.7-p8","2.4.7-p9","2.4.7-p10","2.4.8","2.4.8-p1","2.4.8-p2","2.4.8-p3","2.4.8-p4","2.4.8-p5","2.4.9"],"components":["magento/module-catalog"],"files":[{"path":"app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/js.phtml","change":"modified","package":"magento/module-catalog"}],"stripped":{"tests":[],"docs":[],"outsideCode":[]},"linesChanged":2,"mergeBatched":false,"excluded":null,"sections":{"description":"By using innerText, it will avoid the risk of HTML injection, as these properties automatically escape any HTML special characters in the provided text. This helps prevent cross-site scripting (XSS) vulnerabilities by treating the input as plain text rather than interpreted HTML.","stepsToReproduce":null,"expectedResult":null,"actualResult":null,"source":"pr"},"signatures":[],"labels":{"area":["Security"],"component":["Backend"],"priority":"P2","severity":null,"reportedOn":["2.4.x"]},"categories":["Admin"],"triage":{"model":"@cf/cloudflare/clef","requestHash":"7da9e270293120d61a8552c74825f32aaab7e40ac0d8ddc5bdc21405da607989","isBugfix":0.923,"changeKind":{"choice":"bugfix","probabilities":{"bugfix":0.8936,"feature":0.012,"refactor":0.0627,"tests_only":0.0089,"docs_only":0.0102,"dependency":0.0126},"confidence":0.7634},"scope":{"score":0.119,"probabilities":{"0":0.9042,"1":0.0726,"2":0.0232},"confidence":0.7351},"risk":{"score":0.3967,"probabilities":{"0":0.636,"1":0.3313,"2":0.0327},"confidence":0.273},"area":{"choice":"admin","probabilities":{"catalog":0.2883,"checkout":0.0119,"customer":0.0076,"admin":0.4395,"graphql_api":0.0067,"framework":0.0275,"frontend":0.1978,"other":0.0207},"confidence":0.2192},"securityRelevant":0.972,"reportedVersion":{"choice":"unspecified","probabilities":{"2.4.0":0.0049,"2.4.0-p1":0.0053,"2.4.1":0.0048,"2.4.1-p1":0.0045,"2.4.2":0.0063,"2.4.2-p1":0.0055,"2.4.2-p2":0.0065,"2.4.3":0.0108,"2.4.3-p1":0.0104,"2.4.3-p2":0.0103,"2.4.3-p3":0.0069,"2.4.4":0.0121,"2.4.4-p1":0.0081,"2.4.4-p10":0.0058,"2.4.4-p11":0.0065,"2.4.4-p12":0.0057,"2.4.4-p13":0.0065,"2.4.4-p14":0.0081,"2.4.4-p15":0.0056,"2.4.4-p16":0.007,"2.4.4-p17":0.0061,"2.4.4-p18":0.0052,"2.4.4-p2":0.0031,"2.4.4-p3":0.0033,"2.4.4-p4":0.0035,"2.4.4-p5":0.0043,"2.4.4-p6":0.0045,"2.4.4-p7":0.0047,"2.4.4-p8":0.0049,"2.4.4-p9":0.0047,"2.4.5":0.0144,"2.4.5-p1":0.0109,"2.4.5-p10":0.0072,"2.4.5-p11":0.0112,"2.4.5-p12":0.0103,"2.4.5-p13":0.0077,"2.4.5-p14":0.0087,"2.4.5-p15":0.0073,"2.4.5-p16":0.0085,"2.4.5-p17":0.0074,"2.4.5-p2":0.0041,"2.4.5-p3":0.0052,"2.4.5-p4":0.0051,"2.4.5-p5":0.0047,"2.4.5-p6":0.0061,"2.4.5-p7":0.0062,"2.4.5-p8":0.0054,"2.4.5-p9":0.0051,"2.4.6":0.0236,"2.4.6-p1":0.0147,"2.4.6-p10":0.0138,"2.4.6-p11":0.0113,"2.4.6-p12":0.0106,"2.4.6-p13":0.0116,"2.4.6-p14":0.0103,"2.4.6-p15":0.009,"2.4.6-p2":0.0047,"2.4.6-p3":0.007,"2.4.6-p4":0.0089,"2.4.6-p5":0.0073,"2.4.6-p6":0.0116,"2.4.6-p7":0.0092,"2.4.6-p8":0.0072,"2.4.6-p9":0.0058,"2.4.7":0.0198,"2.4.7-p1":0.0148,"2.4.7-p10":0.0111,"2.4.7-p2":0.0074,"2.4.7-p3":0.012,"2.4.7-p4":0.015,"2.4.7-p5":0.0126,"2.4.7-p6":0.0134,"2.4.7-p7":0.0136,"2.4.7-p8":0.0094,"2.4.7-p9":0.0066,"2.4.8":0.0153,"2.4.8-p1":0.0147,"2.4.8-p2":0.0155,"2.4.8-p3":0.0167,"2.4.8-p4":0.0135,"2.4.8-p5":0.0124,"2.4.9":0.0138,"unspecified":0.2744},"confidence":0.0719},"backportWorthy":{"score":1.5722,"probabilities":{"0":0.0871,"1":0.2536,"2":0.6593},"confidence":0.2599}},"curated":null,"tests":null},"_documentation":"https://magento.watch/api","_description":"Upstream fix magento2-38804 details"}