CVE-2026-44227
Received Received - Intake

Reflected Cross-Site Scripting (XSS) in RT Issue Tracker

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. There are no effective workarounds. Avoid following untrusted RT URLs. This issue has been fixed in version 6.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-44227
EUVD
EUVD-2026-46045

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
bestpractical rt From 6.0.0 (inc) to 6.0.3 (exc)
bestpractical rt 6.0.3
bestpractical request_tracker to 6.0.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44227 is a reflected Cross-Site Scripting (XSS) vulnerability in RT, an open-source issue tracking system. It affects versions 6.0.0 and above, prior to 6.0.3. An attacker can exploit this by tricking an authenticated user into visiting a crafted URL, which executes arbitrary JavaScript in the user's browser session.

Detection Guidance

Detecting this XSS vulnerability requires checking if your RT instance is running a vulnerable version (6.0.0 to 6.0.2). Check the RT version via command line with: grep '^version' /opt/rt4/etc/RT_Config.pm or similar path. If the version is below 6.0.3, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the browser of an authenticated RT user. This could lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the user. The impact is limited to users who click on untrusted RT URLs.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA due to the risk of unauthorized script execution in user browsers. Reflected XSS may allow attackers to steal session cookies or sensitive data, violating confidentiality requirements under these regulations. Organizations using vulnerable RT versions must address this to maintain compliance.

Mitigation Strategies

Upgrade RT to version 6.0.3 or later immediately. There are no effective workarounds, so patching is required. Avoid visiting untrusted RT URLs until patched. Monitor for unusual user activity that may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44227. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart