CVE-2026-105409: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Dassault Systèmes Tuleap Enterprise Edition

This vulnerability is a stored Cross-site Scripting (CWE-79) issue in Tuleap Enterprise Edition, affecting versions >=17.0-1 <=17.0-41 and >=17.5-1 <=17.5-32. It allows an attacker with limited privileges and requiring user interaction to execute arbitrary script code within the browser session of other users. The vulnerability impacts confidentiality and integrity with no impact on availability. It is identified as CVE-2026-105409 and was published on 2026-10-12.

Successful exploitation could lead to execution of arbitrary scripts in the context of affected users' browsers, potentially resulting in theft of sensitive information, session hijacking, or unauthorized actions performed on behalf of the user. The vulnerability has high confidentiality and integrity impact but does not affect availability.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory from Dassault Systèmes for current remediation guidance. Until a fix is applied, limit user privileges and exercise caution with user-generated content to reduce risk.