CVE-2026-27469
CVE-2026-27469 · Isso: Stored XSS via comment website field
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Isso is a lightweight commenting server written in Python and JavaScript. In commits before 0afbfe0691ee237963e8fb0b2ee01c9e55ca2144, there is a stored Cross-Site Scripting (XSS) vulnerability affecting the website and author comment fields. The website field was HTML-escaped using quote=False, which left single and double quotes unescaped. Since the frontend inserts the website value directly into a single-quoted href attribute via string concatenation, a single quote in the URL breaks out of the attribute context, allowing injection of arbitrary event handlers (e.g. onmouseover, onclick). The same escaping is missing entirely from the user-facing comment edit endpoint (PUT /id/) and the moderation edit endpoint (POST /id//edit/). This issue has been patched in commit 0afbfe0691ee237963e8fb0b2ee01c9e55ca2144. To workaround, nabling comment moderation (moderation = enabled = true in isso.cfg) prevents unauthenticated users from publishing comments, raising the bar for exploitation, but it does not fully mitigate the issue since a moderator activating a malicious comment would still expose visitors.
CVSS 6.1 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
isso
- Versions
- < 0afbfe0691ee237963e8fb0b2ee01c9e55ca2144: Affected
No fix published
isso PyPI
- Versions
- 0.10
- 0.10.1
- 0.10.2
- 0.10.3
- 0.10.4
- 0.10.5
- 0.10.6
- 0.11.0
- 0.11.1
- 0.12.0
- 0.12.1
- 0.12.2
- 0.12.4
- 0.12.5
- 0.12.6
- 0.12.6.1
- 0.12.6.2
- 0.13.0
- 0.13.1.dev0
- 0.8
- 0.8.1
- 0.8.2
- 0.8.3
- 0.9
- 0.9.1
- 0.9.10
- 0.9.2
- 0.9.3
- 0.9.4
- 0.9.5
- 0.9.6
- 0.9.7
- 0.9.8
- 0.9.9
- Affected ranges
- ECOSYSTEM: < 0.13.2
Update to 0.13.2