CVE-2026-41524
Stored XSS in Brave CMS via CKEditor Input
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| brave_cms | brave_cms | to 6c56603 (exc) |
| ckeditor | ckeditor | * |
| laravel | laravel | * |
| ajax30 | bravecms | to 6c56603 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows stored cross-site scripting (XSS) via unescaped user input in page and article content, which can lead to the execution of malicious JavaScript in visitors' browsers.
Such a vulnerability can impact compliance with common standards and regulations like GDPR and HIPAA because it may lead to unauthorized access, manipulation, or exposure of sensitive user data through client-side attacks.
Specifically, GDPR requires organizations to protect personal data against unauthorized processing and breaches, and HIPAA mandates safeguarding electronic protected health information (ePHI). Stored XSS vulnerabilities can facilitate data breaches or unauthorized data manipulation, thus potentially violating these regulations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves stored cross-site scripting (XSS) in page or article content entered via the CKEditor rich-text editor in Brave CMS. Detection involves identifying if unescaped JavaScript or HTML content is stored and rendered in the database.
To detect this on your system, you can:
- Check the database content for suspicious JavaScript or HTML tags in page or article body fields.
- Use web application scanning tools to identify stored XSS vulnerabilities by submitting payloads and observing if they are executed upon page load.
Example commands to inspect the database content (assuming a MySQL database) might include:
- mysql -u [user] -p -e "SELECT id, content FROM pages WHERE content LIKE '%<script>%' OR content LIKE '%onerror=%'" [database_name]
- mysql -u [user] -p -e "SELECT id, content FROM articles WHERE content LIKE '%<script>%' OR content LIKE '%onerror=%'" [database_name]
Additionally, you can use browser developer tools or automated scanners to detect if JavaScript injected by editor-role users is executed when loading pages.
Can you explain this vulnerability to me?
This vulnerability exists in Brave CMS, an open-source content management system. Before a specific patch (commit 6c56603), content entered through the CKEditor rich-text editor was stored exactly as input in the database and then rendered using Laravel Blade's unescaped output directive {!! !!}. This means that any JavaScript or HTML code injected by a user with editor privileges would be permanently stored and executed in every visitor's browser when they loaded the page.
How can this vulnerability impact me? :
The vulnerability can lead to cross-site scripting (XSS) attacks, where malicious scripts injected by an editor user run in the browsers of all visitors to the affected pages. This can result in theft of sensitive information, session hijacking, defacement of the website, or other malicious activities that compromise the security and integrity of the website and its users.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Brave CMS to include the patch introduced in commit 6c56603. This patch changes how page and article body content entered through the CKEditor rich-text editor is handled, preventing unescaped rendering of potentially malicious JavaScript or HTML.
Until the patch is applied, avoid allowing editor-role users to input untrusted HTML or JavaScript content, as it will be stored verbatim and executed in visitors' browsers.