https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T09:36:27.920754+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-54049 fkie_cve-2026-54049 2026-10-02T09:36:27.924226+00:00

Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML() directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post. This issue has been patched in versions 23.5, 25.3, and 26.0.

 https://vulnerability.circl.lu/vuln/ghsa-w2x5-gv52-9ccv GHSA-w2x5-gv52-9ccv — Sakai Conversations has a Stored XSS Issue 2026-10-02T09:36:27.924451+00:00

Affected: Maven: org.sakaiproject.conversations:sakai-conversations-impl, Maven: org.sakaiproject.kernel:sakai-kernel-impl, Maven: org.sakaiproject.rubrics:rubrics-impl

### Summary

The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's `unsafeHTML()` directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post.

### Description

The Conversations REST API endpoint `POST /api/sites/{siteId}/topics` accepts a `message` field in the JSON request body. The service layer (`ConversationsServiceImpl`) stores the message directly to the database (`conv_topics.MESSAGE`) without invoking `FormattedText.processFormattedText()` or any equivalent HTML sanitizer.

The same issue affects post replies via `POST /api/sites/{siteId}/topics/{topicId}/posts` and comments stored in `conv_comments`.

On the frontend, `SakaiTopic.js`, `SakaiPost.js`, and `SakaiComment.js` all render the `message` field using LitElement's `unsafeHTML()` directive:

- `SakaiPost.js` lines 429, 432: `${unsafeHTML(this.post.message)}` - `SakaiTopic.js` line 679: `${unsafeHTML(this.topic.message)}` - `SakaiComment.js` line 148: `${unsafeHTML(this.comment.message)}`

Unlike other Sakai tools (Announcements, Assignments, Resources) which call `FormattedText.processFormattedText()` before persisting user content, the Conversations implementation has no equivalent protection at storage time or render time.

##…