CVE-2026-63157: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Omnispace Agora Project

Omnispace Agora Project before version 26.10.0 contains a stored XSS vulnerability due to improper neutralization of input in the 'adress' field submitted by authenticated users. The input is embedded unsanitized into an onclick event-handler attribute, allowing malicious script injection. The vulnerability is exploitable through the Links module, affecting any user who views the compromised links list.

An attacker with authenticated access can inject malicious scripts that execute in the context of other users' browsers when they view the links list. This can lead to session hijacking or further client-side attacks. The vulnerability requires user interaction (viewing the links list) and authenticated attacker privileges to inject the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user privileges to trusted users only and consider sanitizing or validating input fields at the application level to prevent script injection.