CVE-2026-27469

{"id": "CVE-2026-27469", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2026-02-21T08:16:11.993", "references": [{"url": "https://docs.python.org/3/library/html.html#html.escape", "source": "security-advisories@github.com"}, {"url": "https://github.com/isso-comments/isso/commit/0afbfe0691ee237963e8fb0b2ee01c9e55ca2144", "source": "security-advisories@github.com"}, {"url": "https://github.com/isso-comments/isso/security/advisories/GHSA-9fww-8cpr-q66r", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Isso is a lightweight commenting server written in Python and JavaScript. In commits before 0afbfe0691ee237963e8fb0b2ee01c9e55ca2144, there is a stored Cross-Site Scripting (XSS) vulnerability affecting the website and author comment fields. The website field was HTML-escaped using quote=False, which left single and double quotes unescaped. Since the frontend inserts the website value directly into a single-quoted href attribute via string concatenation, a single quote in the URL breaks out of the attribute context, allowing injection of arbitrary event handlers (e.g. onmouseover, onclick). The same escaping is missing entirely from the user-facing comment edit endpoint (PUT /id/) and the moderation edit endpoint (POST /id//edit/). This issue has been patched in commit 0afbfe0691ee237963e8fb0b2ee01c9e55ca2144. To workaround, nabling comment moderation (moderation = enabled = true in isso.cfg) prevents unauthenticated users from publishing comments, raising the bar for exploitation, but it does not fully mitigate the issue since a moderator activating a malicious comment would still expose visitors."}, {"lang": "es", "value": "Isso es un servidor de comentarios ligero escrito en Python y JavaScript. En commits anteriores a 0afbfe0691ee237963e3fb0b2ee01c9e55ca2144, existe una vulnerabilidad de cross-site scripting (XSS) almacenado que afecta los campos de sitio web y de comentario del autor. El campo del sitio web fue escapado en HTML usando quote=False, lo que dej\u00f3 las comillas simples y dobles sin escapar. Dado que el frontend inserta el valor del sitio web directamente en un atributo href entre comillas simples mediante concatenaci\u00f3n de cadenas, una comilla simple en la URL rompe el contexto del atributo, permitiendo la inyecci\u00f3n de manejadores de eventos arbitrarios (p. ej. onmouseover, onclick). El mismo escape est\u00e1 completamente ausente del endpoint de edici\u00f3n de comentarios para el usuario (PUT /id/) y del endpoint de edici\u00f3n de moderaci\u00f3n (POST /id//edit/). Este problema ha sido parcheado en el commit 0afbfe0691ee237963e3fb0b2ee01c9e55ca2144. Como soluci\u00f3n alternativa, habilitar la moderaci\u00f3n de comentarios (moderation = enabled = true en isso.cfg) evita que los usuarios no autenticados publiquen comentarios, elevando la dificultad para la explotaci\u00f3n, pero no mitiga completamente el problema ya que un moderador que active un comentario malicioso a\u00fan expondr\u00eda a los visitantes."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "security-advisories@github.com"}