CVE-2026-55630
Received Received - Intake

Cross-Site Scripting in Kiwi TCMS Prior to 16.1

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a Content-Security-Policy header that blocks inline JavaScript, making exploitation difficult in default deployments, while customized deployments that weaken those security settings may remain vulnerable. Version 16.1 properly sanitizes both fields and resets existing database records that do not validate to null. This issue is fixed in version 16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55630
EUVD
EUVD-2026-78674

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
kiwi kiwi_tcms to 16.1 (exc)
kiwi_tcms kiwi_tcms 16.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kiwi TCMS versions before 16.1 have a cross-site scripting vulnerability due to unsanitized user input in TestCase.extra_link and TestPlan.extra_link fields. These fields render stored values without proper sanitization, allowing potential XSS attacks.

Detection Guidance

Check Kiwi TCMS version with: docker inspect kiwi_tcms | grep -i version or grep version /path/to/kiwi/install. If version is below 16.1, the system is vulnerable. Inspect TestCase.extra_link and TestPlan.extra_link fields in the database for unsanitized input.

Impact Analysis

An attacker could inject malicious scripts via the affected fields, potentially stealing session cookies, redirecting users, or performing actions on their behalf. Default Docker deployments are less vulnerable due to Content-Security-Policy headers, but customized setups may remain at risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data security) requirements. Organizations must ensure proper sanitization to maintain compliance.

Mitigation Strategies

Upgrade Kiwi TCMS to version 16.1 or later. For existing records, reset TestCase.extra_link and TestPlan.extra_link fields to null. Ensure Content-Security-Policy headers are enforced to block inline JavaScript.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55630. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart