From cbcc560bd3dafdd84c441b6eff6a82b82ae98df5 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Wed, 19 Mar 2025 09:33:35 +0200
Subject: [PATCH 1/2] sanitize navbar color

---
 client/src/views/site/navbar.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/client/src/views/site/navbar.js b/client/src/views/site/navbar.js
index e8b533f34c..50ae825bd4 100644
--- a/client/src/views/site/navbar.js
+++ b/client/src/views/site/navbar.js
@@ -1286,6 +1286,13 @@ class NavbarSiteView extends View {
             color = this.getMetadata().get(['clientDefs', tab, 'color']);
         }
 
+        if (
+            color &&
+            !/^#([0-9A-Fa-f]{3}|[0-9A-Fa-f]{6})$/.test(color)
+        ) {
+            color = null;
+        }
+
         if (!params.tabIconsDisabled && !isGroup && !isDivider && !isUrl) {
             iconClass = this.getMetadata().get(['clientDefs', tab, 'iconClass'])
         }

From 0ae0365ee5a1bc567e12788e1ce2f57ad84fb363 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Wed, 19 Mar 2025 11:08:06 +0200
Subject: [PATCH 2/2] 9.0.6

---
 package-lock.json | 4 ++--
 package.json      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index f9f425ff9d..fca9e88f99 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "espocrm",
-  "version": "9.0.5",
+  "version": "9.0.6",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "espocrm",
-      "version": "9.0.5",
+      "version": "9.0.6",
       "hasInstallScript": true,
       "license": "AGPL-3.0-or-later",
       "dependencies": {
diff --git a/package.json b/package.json
index e5cff27a8c..c572772ced 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "espocrm",
-  "version": "9.0.5",
+  "version": "9.0.6",
   "description": "Open-source CRM.",
   "repository": {
     "type": "git",