CVE-2026-41250 is a stored XSS vulnerability in the taiga-front component of the Taiga project management platform. Versions before 6.9.1 do not properly neutralize user input when generating web pages, which can lead to the injection and execution of malicious scripts in the context of other users. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 5.7, indicating medium severity. The vulnerability was published on May 11, 2026, and is fixed in version 6.9.1 of taiga-front.

Successful exploitation of this vulnerability could allow an attacker with low privileges and requiring user interaction to execute malicious scripts in the victim's browser. This could lead to the compromise of user session data or other client-side impacts. There is no indication of impact on confidentiality or availability, and no known exploits in the wild have been reported.

Upgrade taiga-front to version 6.9.1 or later, where this stored XSS vulnerability has been fixed. Since the vendor advisory indicates the issue is resolved in 6.9.1, applying this official fix is the recommended remediation. No other mitigation guidance is provided or necessary.