AI description
CVE-2026-117679 is a cross-site scripting (XSS) vulnerability identified in SHIRASAGI, an open-source web application platform developed by the SHIRASAGI Project. The flaw affects versions 1.12.0 through 1.21.0. It stems from the application's failure to properly neutralize user-controllable input before rendering it on a web page. This allows an authenticated attacker to inject and execute arbitrary scripts in the web browser of any user who accesses a website running the affected software. The vulnerability was reported by Yuto Sato of the Tokyo University of Science to the Information-technology Promotion Agency (IPA), with coordination handled by JPCERT/CC. To address the issue, the SHIRASAGI Project has released version 1.21.1, which patches the vulnerability. Users and administrators are advised to update their installations to the latest version to mitigate potential risks, as there are currently no known active exploits in the wild.
- Description
- A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's web browser when the user accesses a website using the affected product.
- Source
- vultures@jpcert.or.jp
- NVD status
- Received
CVSS 4.0
- Type
- Secondary
- Base score
- 5.1
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- MEDIUM
CVSS 3.0
- Type
- Secondary
- Base score
- 5.4
- Impact score
- 2.7
- Exploitability score
- 2.3
- Vector string
- CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
- vultures@jpcert.or.jp
- CWE-79
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
5