CVE-2026-117679
Received Received - Intake

XSS Vulnerability in SHIRASAGI

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: JPCERT/CC

Description
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's web browser when the user accesses a website using the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-117679
EUVD
EUVD-2026-117398

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SHIRASAGI Project SHIRASAGI v1.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in SHIRASAGI, a CMS. An authenticated attacker with permission to edit advertisement pages can insert malicious scripts into page attributes or links. When a user clicks the advertisement, the script executes in their browser.

Detection Guidance

To detect this vulnerability, check if your SHIRASAGI version is between v1.12.0 and v1.21.0. Verify the installed version by running commands like 'bundle exec rake version' in the SHIRASAGI directory or checking the version in the admin panel. Inspect web pages for suspicious scripts in advertisement attributes or links.

Impact Analysis

An attacker could steal user session cookies, redirect users to malicious sites, or perform actions on behalf of users. This requires the attacker to have access to edit advertisement pages in the admin panel.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA due to potential unauthorized script execution in user browsers. XSS risks can lead to data breaches, unauthorized access, or manipulation of sensitive information, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediately update SHIRASAGI to version v1.21.1 or later. Remove or restrict access for users with advertisement editing privileges until the update is complete. Monitor network traffic for unusual activity related to advertisement pages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117679. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...