[CRITICAL] Contao: Cross-site scripting in the comments bundle

PKSA-c42s-m9fj-8jxw CVE-2026-107845 GHSA-628f-v4f6-p37r

Affected package: contao/comments-bundle

Affected version: >=5.4.0-RC1,<5.7.12|>=4.0.0,<5.3.50

Reported by:
GitHub