CVE-2026-29106
Cross-Site Scripting in SuiteCRM return_id Parameter
Publication date: 2026-03-19
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| suitecrm | suitecrm | to 7.15.1 (exc) |
| suitecrm | suitecrm | From 8.0.0 (inc) to 8.9.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
| CWE-159 | The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity. |
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in SuiteCRM versions prior to 7.15.1 and 8.9.3. It involves the return_id request parameter, which is copied into the value of an HTML tag attribute that acts as an event handler and is enclosed in double quotation marks. This improper handling allows for a cross-site scripting (XSS) vulnerability.
How can this vulnerability impact me? :
The vulnerability can lead to a cross-site scripting (XSS) attack, which may allow an attacker to execute malicious scripts in the context of the affected application. According to the CVSS score, it has a base score of 5.9 with impacts on confidentiality, integrity, and availability, meaning it can partially compromise data confidentiality, data integrity, and system availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade SuiteCRM to versions 7.15.1 or 8.9.3 or later, as these versions contain patches for the issue.
Additionally, implementing a Content Security Policy (CSP) header is recommended to completely mitigate the cross-site scripting (XSS) vulnerability.