Security release addressing the findings of the Mautic marketplace allowlist review (marketplace-allowlist#21):
- XSS (high): the inline builder settings printed into a
<script>block are now encoded withJSON_HEX_TAG, so a config value containing</script>can no longer break out of the block. Covered by a new functional test. - SSRF (medium):
base_urlis only honoured when it parses to an http(s) URL; any other scheme falls back to the provider default. - Telemetry (low): a failure to persist the generation record is now logged at error level instead of being swallowed silently.
Upgrading is recommended for all installations.