The Sakai Conversations tool in sakai versions >=23.0 <23.5 and >=25.0 <25.3 improperly neutralizes input during web page generation by storing topic and post messages without HTML sanitization. The frontend uses LitElement's unsafeHTML() directive to render these messages, resulting in stored cross-site scripting (CWE-79). Authenticated users with access to a site having the Conversations tool enabled can inject arbitrary HTML and JavaScript, which executes in the browsers of other users viewing those topics or posts. This issue is addressed in sakai versions 23.5, 25.3, and 26.0.

An attacker with authenticated access to a site using the Conversations tool can inject malicious HTML and JavaScript that executes in the browsers of other users who view the injected content. This can lead to compromise of user sessions, theft of sensitive information, or other high-impact consequences. The CVSS score is 8.7 (high severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high confidentiality and integrity impact with no availability impact.

This vulnerability has been patched in sakai versions 23.5, 25.3, and 26.0. Users should upgrade to one of these versions or later to remediate the issue. No additional mitigation steps are indicated beyond applying the official patches.