Kiwitcms: Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase) (CVE-2026-55630)
## Summary In Kiwi TCMS the fields `TestCase.extra_link` and `TestPlan.extra_link` were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value. ## Impact Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a `Content-Security-Policy` header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.
AI Analysis
Technical Summary
Kiwi TCMS prior to version 16.1 allows stored XSS via the extra_link fields in TestCase and TestPlan because user input is not sanitized and is rendered directly. This vulnerability is mitigated in version 16.1 by proper sanitization and resetting invalid database entries. Official Docker images send a Content-Security-Policy header that prevents inline JavaScript execution, reducing practical exploitability. However, deployments that alter or remove this header may be exposed to XSS attacks.
Potential Impact
The vulnerability allows stored cross-site scripting through unsanitized JavaScript URIs in extra_link fields, potentially enabling script execution in the context of the Kiwi TCMS web interface. However, the default Content-Security-Policy header in official deployments blocks inline JavaScript, making exploitation difficult. Customized deployments that disable or modify this policy may be vulnerable to XSS attacks, which could lead to session hijacking or other client-side impacts. There is no impact on confidentiality, integrity, or availability as per the CVSS vector.
Mitigation Recommendations
Upgrade to Kiwi TCMS version 16.1 or later, where the extra_link fields are properly sanitized and invalid entries are reset. For deployments unable to upgrade immediately, ensure the Content-Security-Policy header is enabled and not modified to block inline JavaScript execution. Review and sanitize any existing database entries in extra_link fields to remove malicious scripts. No known exploits are reported in the wild.
Kiwitcms: Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase) (CVE-2026-55630)
Description
## Summary In Kiwi TCMS the fields `TestCase.extra_link` and `TestPlan.extra_link` were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value. ## Impact Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a `Content-Security-Policy` header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.
CVSS v3.1
Score 0.0none
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Kiwi TCMS prior to version 16.1 allows stored XSS via the extra_link fields in TestCase and TestPlan because user input is not sanitized and is rendered directly. This vulnerability is mitigated in version 16.1 by proper sanitization and resetting invalid database entries. Official Docker images send a Content-Security-Policy header that prevents inline JavaScript execution, reducing practical exploitability. However, deployments that alter or remove this header may be exposed to XSS attacks.
Potential Impact
The vulnerability allows stored cross-site scripting through unsanitized JavaScript URIs in extra_link fields, potentially enabling script execution in the context of the Kiwi TCMS web interface. However, the default Content-Security-Policy header in official deployments blocks inline JavaScript, making exploitation difficult. Customized deployments that disable or modify this policy may be vulnerable to XSS attacks, which could lead to session hijacking or other client-side impacts. There is no impact on confidentiality, integrity, or availability as per the CVSS vector.
Mitigation Recommendations
Upgrade to Kiwi TCMS version 16.1 or later, where the extra_link fields are properly sanitized and invalid entries are reset. For deployments unable to upgrade immediately, ensure the Content-Security-Policy header is enabled and not modified to block inline JavaScript execution. Review and sanitize any existing database entries in extra_link fields to remove malicious scripts. No known exploits are reported in the wild.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-473p-56xx-vg67
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-55630"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a4c33f027e9c797195ec8a5
Added to database: 07/06/2026, 23:02:08 UTC
Last enriched: 07/06/2026, 23:06:10 UTC
Last updated: 07/31/2026, 13:37:38 UTC
Views: 40
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.