GHSA-473p-56xx-vg67: Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
Kiwi TCMS versions up to 12.4 have a stored cross-site scripting (XSS) vulnerability in the TestCase.extra_link and TestPlan.extra_link fields. These fields were intended to store URLs but did not sanitize user input, allowing JavaScript URIs to be rendered verbatim. Version 16.1 fixes this by sanitizing these fields and resetting invalid existing records to null. Official Docker deployments include a Content-Security-Policy header that mitigates exploitation by blocking inline JavaScript, but customized deployments with modified security settings may remain vulnerable.
AI Analysis
Technical Summary
Kiwi TCMS prior to version 16.1 allows stored XSS via the extra_link fields in TestCase and TestPlan because user input is not sanitized and is rendered directly. This vulnerability is mitigated in version 16.1 by proper sanitization and resetting invalid database entries. Official Docker images send a Content-Security-Policy header that prevents inline JavaScript execution, reducing practical exploitability. However, deployments that alter or remove this header may be exposed to XSS attacks.
Potential Impact
The vulnerability allows stored cross-site scripting through unsanitized JavaScript URIs in extra_link fields, potentially enabling script execution in the context of the Kiwi TCMS web interface. However, the default Content-Security-Policy header in official deployments blocks inline JavaScript, making exploitation difficult. Customized deployments that disable or modify this policy may be vulnerable to XSS attacks, which could lead to session hijacking or other client-side impacts. There is no impact on confidentiality, integrity, or availability as per the CVSS vector.
Mitigation Recommendations
Upgrade to Kiwi TCMS version 16.1 or later, where the extra_link fields are properly sanitized and invalid entries are reset. For deployments unable to upgrade immediately, ensure the Content-Security-Policy header is enabled and not modified to block inline JavaScript execution. Review and sanitize any existing database entries in extra_link fields to remove malicious scripts. No known exploits are reported in the wild.
GHSA-473p-56xx-vg67: Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
Description
Kiwi TCMS versions up to 12.4 have a stored cross-site scripting (XSS) vulnerability in the TestCase.extra_link and TestPlan.extra_link fields. These fields were intended to store URLs but did not sanitize user input, allowing JavaScript URIs to be rendered verbatim. Version 16.1 fixes this by sanitizing these fields and resetting invalid existing records to null. Official Docker deployments include a Content-Security-Policy header that mitigates exploitation by blocking inline JavaScript, but customized deployments with modified security settings may remain vulnerable.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Kiwi TCMS prior to version 16.1 allows stored XSS via the extra_link fields in TestCase and TestPlan because user input is not sanitized and is rendered directly. This vulnerability is mitigated in version 16.1 by proper sanitization and resetting invalid database entries. Official Docker images send a Content-Security-Policy header that prevents inline JavaScript execution, reducing practical exploitability. However, deployments that alter or remove this header may be exposed to XSS attacks.
Potential Impact
The vulnerability allows stored cross-site scripting through unsanitized JavaScript URIs in extra_link fields, potentially enabling script execution in the context of the Kiwi TCMS web interface. However, the default Content-Security-Policy header in official deployments blocks inline JavaScript, making exploitation difficult. Customized deployments that disable or modify this policy may be vulnerable to XSS attacks, which could lead to session hijacking or other client-side impacts. There is no impact on confidentiality, integrity, or availability as per the CVSS vector.
Mitigation Recommendations
Upgrade to Kiwi TCMS version 16.1 or later, where the extra_link fields are properly sanitized and invalid entries are reset. For deployments unable to upgrade immediately, ensure the Content-Security-Policy header is enabled and not modified to block inline JavaScript execution. Review and sanitize any existing database entries in extra_link fields to remove malicious scripts. No known exploits are reported in the wild.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-473p-56xx-vg67
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-55630"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a4c33f027e9c797195ec8a5
Added to database: 07/06/2026, 23:02:08 UTC
Last enriched: 07/06/2026, 23:06:10 UTC
Last updated: 07/06/2026, 23:06:10 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.