{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/rubrics-impl-23.0-23.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["sakai-conversations-impl (23.0-23.3)","sakai-kernel-impl (23.0-23.3)","rubrics-impl (23.0-23.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Sakai"],"content_html":"\u003cp\u003eThe Sakai Conversations tool, part of the Sakai LMS framework, contains a stored XSS vulnerability (CVE-2026-54049) affecting versions 23.0 through 23.3. The vulnerability stems from the Conversations REST API failing to sanitize user-provided message input before persisting it to the database, combined with the frontend's use of LitElement's \u003ccode\u003eunsafeHTML()\u003c/code\u003e directive to render these messages.\u003c/p\u003e\n\u003cp\u003eAn attacker with any authenticated site role can inject malicious payloads via the \u003ccode\u003emessage\u003c/code\u003e field in the \u003ccode\u003e/api/sites/{siteId}/topics\u003c/code\u003e or \u003ccode\u003e/api/sites/{siteId}/topics/{topicId}/posts\u003c/code\u003e endpoints. When other users navigate to the affected conversation thread, the frontend renders the unsanitized HTML, resulting in arbitrary JavaScript execution within the victim's session. This vulnerability poses a significant risk to university environments, as it facilitates account takeover, unauthorized access to sensitive course data, and large-scale compromise of student accounts. A fix has been committed in commit \u003ccode\u003e2696b4b48cbef2e81512f52f84f7477adff78b27\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to a Sakai instance with at least student-level permissions.\u003c/li\u003e\n\u003cli\u003eAttacker selects a site where the Conversations tool is enabled.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious payload containing JavaScript, such as \u003ccode\u003e\u0026lt;img src=x onerror=alert(1)\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP POST request to \u003ccode\u003e/api/sites/{siteId}/topics\u003c/code\u003e or \u003ccode\u003e/api/sites/{siteId}/topics/{topicId}/posts\u003c/code\u003e with the malicious payload in the \u003ccode\u003emessage\u003c/code\u003e JSON field.\u003c/li\u003e\n\u003cli\u003eThe Conversations service layer accepts the input without sanitization and commits the raw payload to the database.\u003c/li\u003e\n\u003cli\u003eA victim user navigates to the affected topic or post in the Sakai frontend.\u003c/li\u003e\n\u003cli\u003eThe LitElement web component fetches the data and renders the payload via \u003ccode\u003eunsafeHTML()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe browser executes the malicious script in the context of the victim's session, leading to potential data exfiltration or session hijacking.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to execute arbitrary code within the browsers of all users viewing the compromised thread. In a university setting, this can lead to the mass exfiltration of gradebook data, course content, and unauthorized administrative actions if a privileged user views the content. The scope includes any deployment of Sakai 23.0 through 23.3.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Sakai installations to a version containing the fix for CVE-2026-54049 once released.\u003c/li\u003e\n\u003cli\u003eImplement strict Content Security Policy (CSP) headers to prevent the execution of unauthorized inline scripts.\u003c/li\u003e\n\u003cli\u003eDeploy web application firewall (WAF) rules to detect and block common XSS payloads in JSON bodies directed at \u003ccode\u003e/api/sites/*/topics\u003c/code\u003e and \u003ccode\u003e/api/sites/*/topics/*/posts\u003c/code\u003e endpoints.\u003c/li\u003e\n\u003cli\u003eReview access control lists for the Conversations tool to ensure only trusted users have the ability to contribute to threads.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-24T21:58:07Z","date_published":"2026-08-24T21:58:07Z","id":"https://feed.craftedsignal.io/briefs/2026-08-sakai-xss/","summary":"The Sakai Conversations tool suffers from a stored cross-site scripting (XSS) vulnerability, CVE-2026-54049, allowing authenticated users to execute arbitrary JavaScript in the browsers of other site members.","title":"Stored XSS in Sakai Conversations","url":"https://feed.craftedsignal.io/briefs/2026-08-sakai-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Rubrics-Impl (23.0-23.3)","version":"https://jsonfeed.org/version/1.1"}