Advisory Weakness Curation

OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor # Impact Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager # Relates to - https://github.com/artf/grapesjs/issues/4411 https://github.com/artf/grapesjs/issues/4411 # Patch Update GrapeJS dependency to >=v0.19.5 https://github.com/artf/grapesjs/releases/tag/v0.19.5

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in oro/commerce.