Skip to content

Conversation

@gortiz-dotcms
Copy link
Contributor

@gortiz-dotcms gortiz-dotcms commented Feb 2, 2026

Problem

The language used for getting the related content was the default one

Fix

Now when querying, the value of the languageId (if present) is being extracted from the query and used instead of the default

This PR fixes: #34285

@semgrep-code-dotcms-test
Copy link

Semgrep found 1 ssc-4fd3a3fc-acff-4277-9d88-60469f5a4fa5 finding:

  • core-web/libs/sdk/angular/src/lib/components/dotcms-layout-body/components/row/row.component.ts

Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the href and xlink:href attributes on SVG <script> elements as Resource URL contexts. This allows an attacker to bind a malicious data: URI or external script via [attr.href] or [attr.xlink:href], resulting in arbitrary JavaScript execution (XSS) in the victim's browser.

Fix: Upgrade this library to at least version 20.3.16 at core/core-web/yarn.lock:512.

Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610

If this is a critical or high severity finding, please also link this issue in the #security channel in Slack.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

[DEFECT] Querying related content on an non-default lang not being respected

2 participants