CVE-2026-96535: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in YouMind YouMind web application

This vulnerability (CVE-2026-96535) in the YouMind web application involves improper neutralization of input during web page generation (CWE-79). Specifically, the avatar update endpoint accepts an SVG image URL without sanitizing or validating the SVG content. An attacker can embed JavaScript code inside the SVG, which executes when the image is served by the CDN and accessed, leading to cross-site scripting within the CDN domain context. The CVSS 4.0 base score is 5.1, indicating medium severity, with network attack vector, low attack complexity, and requiring user interaction and low privileges.

Successful exploitation allows execution of arbitrary JavaScript code in the context of the CDN domain serving the SVG avatar image. This can lead to potential session hijacking, unauthorized actions, or other XSS-related impacts within the scope of the CDN domain. However, the vulnerability requires user interaction and low privileges, and the impact on confidentiality and integrity is low.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users and administrators should avoid setting SVG images as avatars from untrusted sources or URLs. Monitoring vendor communications for updates is recommended.