CVE-2026-27169
Stored XSS in OpenSift Chat UI Enables Authenticated Script Execution
Publication date: 2026-02-21
Last updated on: 2026-02-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| opensift | opensift | to 1.1.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-27169 is a high-severity persistent Cross-Site Scripting (XSS) vulnerability in the OpenSift chat tool rendering component affecting versions 1.1.2-alpha and below.'}, {'type': 'paragraph', 'content': 'The vulnerability arises because the application uses unsafe HTML interpolation patterns to render untrusted user or AI model-generated content in the chat UI, such as titles, previews, notes, and flashcard values.'}, {'type': 'paragraph', 'content': "This improper handling allows stored malicious scripts to execute in authenticated users' browsers when they view the affected content."}, {'type': 'paragraph', 'content': 'An attacker who can influence stored study, quiz, or flashcard content could trigger script execution in a victim’s browser, potentially performing actions with the victim’s privileges within the local application session.'}, {'type': 'paragraph', 'content': 'The issue was fixed in version 1.1.3-alpha by replacing unsafe rendering with safe DOM construction and proper encoding and escaping of user input.'}] [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute arbitrary JavaScript code in your browser when you view maliciously crafted stored content within the OpenSift application.
Such script execution can lead to unauthorized actions performed with your user privileges in the local app session, potentially compromising your data confidentiality and integrity.
Because the attack is persistent, malicious scripts remain stored and can affect multiple users who access the infected content.
The CVSS v3.1 base score of 8.9 reflects a high impact with network attack vector, low attack complexity, and low privileges required, meaning the vulnerability is relatively easy to exploit remotely.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability is a persistent Cross-Site Scripting (XSS) issue in OpenSift versions 1.1.2-alpha and below, caused by unsafe HTML interpolation of untrusted user or model content in the chat tool UI. Detection involves identifying if your OpenSift deployment is running a vulnerable version and if stored content contains malicious scripts that execute in authenticated sessions.
There are no specific detection commands provided in the available resources. However, general approaches include:
- Check the OpenSift version installed; if it is 1.1.2-alpha or below, it is vulnerable.
- Review stored study, quiz, or flashcard content for suspicious HTML or JavaScript code.
- Monitor browser developer tools for unexpected script execution when viewing chat tool UI surfaces.
- Use web application security scanners that detect stored XSS vulnerabilities in web applications.
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to upgrade OpenSift to version 1.1.3-alpha or later, where the vulnerability has been fixed by replacing unsafe HTML rendering with safe DOM construction and proper escaping of untrusted content.
Additional mitigation measures include:
- Avoid using or rendering untrusted user or model-generated HTML content directly in the chat tool UI.
- Apply any available patches or updates from the OpenSift project promptly.
- Review and enforce strict input validation and output encoding policies.
- Consider restricting user privileges to limit the ability to inject malicious content.