Technical impact
Taiga front is vulnerable to stored XSS, allowing an attacker to inject malicious scripts that are later executed in the browsers of users viewing the affected content. The weakness, classified as CWE‑79, can lead to session hijacking, defacement, or theft of sensitive client‑side information. The vulnerability is reflected in saved data fields, meaning any user who can input data into the front‑end may influence scripts delivered to other users.
Affected Systems
The taigaio taiga‑front product is affected. All releases prior to version 6.9.1 are susceptible. Upgrading to version 6.9.1 or later includes the fix. No other products or versions are listed as impacted.
Risk and Exploitability
The CVSS score of 5.7 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no widespread commercial exploitation has been documented. The likely attack vector involves user input that is stored by the front‑end; any authenticated or unauthenticated user capable of creating or editing stored content could trigger the exploit. Because the issue is a stored XSS, it requires access to the affected system or a compromised account to supply malicious payloads.
