Description
Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML() directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post. This issue has been patched in versions 23.5, 25.3, and 26.0.
Published: 2026-10-01
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Patch Now
AI Analysis

Impact

The vulnerability is a stored cross‑site scripting flaw that arises because topic and post messages are saved without sanitization and later rendered unsafely in a web component, allowing arbitrary HTML and JavaScript to be persisted. Attackers can compromise the confidentiality, integrity, and availability of user sessions by injecting malicious scripts that execute in other users’ browsers when they view the content. This flaw is classified as CWE‑79.

Affected Systems

The flaw affects Sakai Collaboration and Learning Environment versions 23.0 through 23.4 and 25.0 through 25.2 inclusive. The Sakai community project released patches in the .5, 25.3, and 26.0 releases.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, but the risk remains significant due to the widespread use of Sakai in educational institutions. Attackers likely need to be authenticated contributors to a site that has the Conversations tool enabled; once they inject payloads, any user who views the corrupt topic or post will have the injected code executed in their browser context.

Generated by OpenCVE AI on October 1, 2026 at 22:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade all Sakai sites that use the Conversations tool to versions 23.5, 25.3, or 26.0.
  • If an immediate upgrade is not possible, disable the Conversations tool on unpatched sites to prevent further exploitation.
  • Review and manually remove any existing unsanitized content within the Conversations tool, or have authors resubmit their posts after sanitization.

Generated by OpenCVE AI on October 1, 2026 at 22:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-w2x5-gv52-9ccv Sakai Conversations has a Stored XSS Issue
History

Tue, 06 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Sakaiproject
Sakaiproject sakai
Vendors & Products Sakaiproject
Sakaiproject sakai

Thu, 01 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Description Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML() directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post. This issue has been patched in versions 23.5, 25.3, and 26.0.
Title Sakai Conversations has a Stored XSS Issue
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'}

Subscriptions

Sakaiproject Sakai
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-06T02:08:38.936Z

Reserved: 2026-06-11T18:24:35.095Z

Link: CVE-2026-54049

cve-icon Vulnrichment

Updated: 2026-10-06T02:08:33.966Z

cve-icon NVD

Status : Deferred

Published: 2026-10-01T20:17:25.587

Modified: 2026-10-06T03:17:03.230

Link: CVE-2026-54049

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T23:00:20Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')