CVE-2026-55630

描述

## Summary In Kiwi TCMS the fields `TestCase.extra_link` and `TestPlan.extra_link` were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value. ## Impact Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a `Content-Security-Policy` header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.

如何修補 CVE-2026-55630

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本
• —未列出修補版本

CVE-2026-55630 正在被利用嗎?

目前沒有被利用訊號。CVE-2026-55630 既不在 CISA KEV 也沒有最新的 EPSS 分數。

受影響套件(2)

• from 0, <= 12.4
• from 0, <= 12.4

CVSS 分數

參考連結(7)

• ADVISORYgithub.com/advisories/GHSA-473p-56xx-vg67
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-55630
• PATCHgithub.com/kiwitcms/Kiwi
• PATCHpypi.org/project/kiwitcms
• WEBgithub.com/kiwitcms/Kiwi/releases/tag/v16.1