Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
Summary
In Kiwi TCMS the fields TestCase.extra_link and TestPlan.extra_link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value.
Impact
Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a Content-Security-Policy header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | kiwitcms | <= 12.4 | sin corrección |
Referencias
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-473p-56xx-vg67
- https://github.com/kiwitcms/Kiwi
- https://github.com/kiwitcms/Kiwi/releases/tag/v16.1
- https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/24/kiwi-tcms-161
- https://pypi.org/project/kiwitcms
- https://github.com/advisories/GHSA-473p-56xx-vg67
- https://nvd.nist.gov/vuln/detail/CVE-2026-55630
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N- Debilidad (CWE)
CWE-79- Plataforma
- Python (PyPI)
- Paquete
kiwitcms- Publicada
- 06.07.2026
- Actualizado
- 11.10.2026 14:18
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-2551 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-473p-56xx-vg67 - CC BY 4.0
Historial de vulnerabilidades: kiwitcms
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 13
- Primera → última
- 11.2022 07.2026
- Sin corrección
- 3
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 7
- Media 3
- Baja 3
Divulgaciones por año
- 2022: 1
- 2023: 9
- 2024: 0
- 2025: 0
- 2026: 3
-
Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase) esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.