CVE-2026-77838: Cross-site scripting (XSS) in Tsuyoshi Saito SOY Calendar

CVE-2026-77838 is a cross-site scripting vulnerability in SOY Calendar. The flaw permits arbitrary script execution in the context of the user's browser session upon login, potentially leading to information disclosure or session manipulation. The vulnerability has a CVSS 3.0 base score of 5.4, indicating medium severity, with attack vector network, low attack complexity, requiring privileges and user interaction, and impacting confidentiality and integrity with no impact on availability. No patch or official remediation information is currently available.

An attacker can execute arbitrary scripts in the browser of a user who logs into SOY Calendar, potentially compromising user confidentiality and integrity of data within the application session. There is no indication of availability impact. Exploitation requires the user to log in and interact with the malicious content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should exercise caution with untrusted inputs and consider limiting user privileges to reduce risk.