Vulnerability-Lookup

CVE-2026-55630 (GCVE-0-2026-55630)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:35 – Updated: 2026-09-15 15:35

Title

Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)

Summary

Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a Content-Security-Policy header that blocks inline JavaScript, making exploitation difficult in default deployments, while customized deployments that weaken those security settings may remain vulnerable. Version 16.1 properly sanitizes both fields and resets existing database records that do not validate to null. This issue is fixed in version 16.1.

Severity

0 (None)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/kiwitcms/Kiwi/security/advisor…	x_refsource_CONFIRM
https://github.com/kiwitcms/Kiwi/commit/1c2ecc848…	x_refsource_MISC
https://github.com/kiwitcms/Kiwi/commit/d5d36e74c…	x_refsource_MISC
https://github.com/kiwitcms/Kiwi/releases/tag/v16.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
kiwitcms	Kiwi	Affected: < 16.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Kiwi",
          "vendor": "kiwitcms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a Content-Security-Policy header that blocks inline JavaScript, making exploitation difficult in default deployments, while customized deployments that weaken those security settings may remain vulnerable. Version 16.1 properly sanitizes both fields and resets existing database records that do not validate to null. This issue is fixed in version 16.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:35:29.097Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-473p-56xx-vg67",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-473p-56xx-vg67"
        },
        {
          "name": "https://github.com/kiwitcms/Kiwi/commit/1c2ecc8485faeefd84a526314a0a60d132fbbc09",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kiwitcms/Kiwi/commit/1c2ecc8485faeefd84a526314a0a60d132fbbc09"
        },
        {
          "name": "https://github.com/kiwitcms/Kiwi/commit/d5d36e74cf9333cb37e3a8743b22b74dfa9a0139",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kiwitcms/Kiwi/commit/d5d36e74cf9333cb37e3a8743b22b74dfa9a0139"
        },
        {
          "name": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1"
        }
      ],
      "source": {
        "advisory": "GHSA-473p-56xx-vg67",
        "discovery": "UNKNOWN"
      },
      "title": "Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan \u0026 TestCase)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55630",
    "datePublished": "2026-09-15T15:35:29.097Z",
    "dateReserved": "2026-06-16T23:52:12.056Z",
    "dateUpdated": "2026-09-15T15:35:29.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-55630\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-15T16:17:14.850\",\"lastModified\":\"2026-09-15T16:17:14.850\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a Content-Security-Policy header that blocks inline JavaScript, making exploitation difficult in default deployments, while customized deployments that weaken those security settings may remain vulnerable. Version 16.1 properly sanitizes both fields and resets existing database records that do not validate to null. This issue is fixed in version 16.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"kiwitcms\",\"product\":\"Kiwi\",\"versions\":[{\"version\":\"\u003c 16.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N\",\"baseScore\":0.0,\"baseSeverity\":\"NONE\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":0.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://github.com/kiwitcms/Kiwi/commit/1c2ecc8485faeefd84a526314a0a60d132fbbc09\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kiwitcms/Kiwi/commit/d5d36e74cf9333cb37e3a8743b22b74dfa9a0139\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kiwitcms/Kiwi/releases/tag/v16.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-473p-56xx-vg67\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

FKIE_CVE-2026-55630

Vulnerability from fkie_nvd - Published: 2026-09-15 16:17 - Updated: 2026-09-15 16:17

Severity

0.0 (None) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/kiwitcms/Kiwi/commit/1c2ecc8485faeefd84a526314a0a60d132fbbc09
	security-advisories@github.com	https://github.com/kiwitcms/Kiwi/commit/d5d36e74cf9333cb37e3a8743b22b74dfa9a0139
	security-advisories@github.com	https://github.com/kiwitcms/Kiwi/releases/tag/v16.1
	security-advisories@github.com	https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-473p-56xx-vg67

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Kiwi",
          "vendor": "kiwitcms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a Content-Security-Policy header that blocks inline JavaScript, making exploitation difficult in default deployments, while customized deployments that weaken those security settings may remain vulnerable. Version 16.1 properly sanitizes both fields and resets existing database records that do not validate to null. This issue is fixed in version 16.1."
    }
  ],
  "id": "CVE-2026-55630",
  "lastModified": "2026-09-15T16:17:14.850",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 0.0,
          "baseSeverity": "NONE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 0.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-15T16:17:14.850",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kiwitcms/Kiwi/commit/1c2ecc8485faeefd84a526314a0a60d132fbbc09"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kiwitcms/Kiwi/commit/d5d36e74cf9333cb37e3a8743b22b74dfa9a0139"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-473p-56xx-vg67"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-473P-56XX-VG67

Vulnerability from github – Published: 2026-07-06 21:49 – Updated: 2026-07-06 21:49

Summary

Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Details

Summary

In Kiwi TCMS the fields TestCase.extra_link and TestPlan.extra_link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value.

Impact

Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a Content-Security-Policy header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.

Severity

0.0 (None)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "kiwitcms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "12.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55630"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-06T21:49:41Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\nIn Kiwi TCMS the fields `TestCase.extra_link` and `TestPlan.extra_link` were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don\u0027t validate will be reset to a null value.\n\n\n## Impact\n\nDeployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a `Content-Security-Policy` header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.",
  "id": "GHSA-473p-56xx-vg67",
  "modified": "2026-07-06T21:49:41Z",
  "published": "2026-07-06T21:49:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-473p-56xx-vg67"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kiwitcms/Kiwi"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1"
    },
    {
      "type": "WEB",
      "url": "https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/24/kiwi-tcms-161"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan \u0026 TestCase)"
}

PYSEC-2026-2551

Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:04

Details

Summary

Impact

Severity

0.0 (None)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

Impacted products

Name	purl
kiwitcms	pkg:pypi/kiwitcms

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "kiwitcms",
        "purl": "pkg:pypi/kiwitcms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "12.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0",
        "10.1",
        "10.2",
        "10.3",
        "10.3.999",
        "10.4",
        "10.5",
        "11.0",
        "11.1",
        "11.3",
        "11.4",
        "11.5",
        "11.6",
        "11.7",
        "12.0",
        "12.1",
        "12.2",
        "12.3",
        "12.4",
        "6.10",
        "6.11",
        "6.2.1",
        "6.3",
        "6.4",
        "6.5",
        "6.5.3",
        "6.6",
        "6.7",
        "6.8",
        "6.9",
        "7.0",
        "7.1",
        "7.2",
        "7.2.1",
        "7.3",
        "8.0",
        "8.1",
        "8.1.99",
        "8.2",
        "8.3",
        "8.4",
        "8.5",
        "8.6",
        "8.6.1",
        "8.7",
        "8.8",
        "8.9",
        "9.0",
        "9.999"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55630",
    "GHSA-473p-56xx-vg67"
  ],
  "details": "## Summary\n\nIn Kiwi TCMS the fields `TestCase.extra_link` and `TestPlan.extra_link` were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don\u0027t validate will be reset to a null value.\n\n\n## Impact\n\nDeployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a `Content-Security-Policy` header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.",
  "id": "PYSEC-2026-2551",
  "modified": "2026-07-13T16:04:27.718301Z",
  "published": "2026-07-13T15:46:28.995169Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-473p-56xx-vg67"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kiwitcms/Kiwi"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1"
    },
    {
      "type": "WEB",
      "url": "https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/24/kiwi-tcms-161"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/kiwitcms"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-473p-56xx-vg67"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55630"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan \u0026 TestCase)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-55630 (GCVE-0-2026-55630)

FKIE_CVE-2026-55630

GHSA-473P-56XX-VG67

Summary

Impact

PYSEC-2026-2551

Summary

Impact

Tags

Sightings

Nomenclature