CVE-2026-54694: CWE-20: Improper Input Validation in NationalSecurityAgency skills-service
Affects NationalSecurityAgency skills-serviceSource CVE Database V5
Not known to be exploited · CVSS 9.6 Critical · patch available : patch NationalSecurityAgency skills-service as a priority.
Data as of 10/25/2026, 04:40:13 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 39% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:LWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| NationalSecurityAgencyskills-service | Affected
| Fixed in
|
GitHubnationalsecurityagency/skills-servicepkg:github/nationalsecurityagency/skills-serviceOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available in version 4.4.2 that addresses the improper input validation and sanitization issues. Users of the skills-service should upgrade to version 4.4.2 or later. Since this is a cloud-hosted service, the vendor manages remediation server-side; verify with the vendor advisory that the service is updated. No additional mitigation steps are required if the patch is applied.
Description
CVE-2026-54694 is a critical improper input validation vulnerability in the NationalSecurityAgency's skills-service (SkillTree platform) prior to version 4.4.2. It involves unfiltered HTML input in user registration fields that leads to cross-site scripting (XSS) attacks when administrators view quiz runs. There are three escalating exploitation paths: basic XSS, remote script loading allowing arbitrary admin actions, and full cross-site request forgery (CSRF) token theft enabling API abuse. The vulnerability is patched in version 4.4.2.
Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the administrator's browser without additional interaction beyond normal use. This can lead to full compromise of the admin interface, including deletion of projects, creation of backdoor accounts, data exfiltration, installation of keyloggers, and theft of CSRF tokens to perform unauthorized API calls. The vulnerability impacts confidentiality, integrity, and availability of the affected system.
Summary
SkillTree, a micro-learning gamification platform, has an improper input validation vulnerability (CWE-20) that combines two code flaws into an exploitable attack chain. The first flaw is that the `StringHighlighter.js` file interpolates raw user input into HTML without encoding, and the `HighlightedValue.vue` component renders this via Vue's `v-html`, setting `innerHTML` unsafely. The second flaw is that the registration endpoint accepts `firstName`, `lastName`, and `nickname` fields without HTML sanitization. An attacker can register with malicious HTML/JavaScript payloads that execute when an administrator views the Quiz Runs page. Exploitation paths range from simple XSS to remote script loading via dynamic import, and finally to theft of CSRF tokens by leveraging `eval(name)` and same-origin policy, enabling unauthorized admin API actions. The vulnerability is fixed in version 4.4.2.
Weaknesses
- CWE-20Improper Input Validation (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #18OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #1OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-116Improper Encoding or Escaping of Output (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A05:2025: Injection (opens in a new tab)
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
- CWE-183Permissive List of Allowed Inputs (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
- CWE-693Protection Mechanism Failure (opens in a new tab)
Pillar weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.