CVE-2026-115993: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in CervantesSec cervantes

This vulnerability (CVE-2026-115993) is a stored XSS issue in CervantesSec's cervantes product, specifically in the Notes field of the Checklists in version v1.3-beta. It arises from improper neutralization of input during web page generation (CWE-79). An attacker could exploit this to execute arbitrary code in the context of another user's browser session with elevated privileges. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires privileges, user interaction, and results in high confidentiality impact but no integrity or availability impact.

Successful exploitation allows an attacker to execute arbitrary code in the victim's browser with elevated privileges, potentially leading to unauthorized access to sensitive information. However, the integrity and availability of the system are not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

No official patch or remediation guidance is currently available. Users should monitor the vendor's advisories for updates. Until a fix is released, cautious handling of user input in the Notes field and restricting privileges where possible may reduce risk.