Read the docs
TI-2026-30518 Aliases CVE-2026-42197

RELATE Vulnerable to Stored XSS via Unprivileged User Profile

Priority LOW 39CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session, potentially leading to full admin account takeover. The `get_user()` method in `ParticipationAdmin` renders user-controlled input using `mark_safe` combined with Python's % string formatting. This bypasses Django\'s automatic HTML escaping entirely. The value returned by `get_full_name` is derived directly from the `first_name` and `last_name` fields of the User model. These fields are freely editable by any authenticated user through the profile page (`/profile/`) with no sanitization applied. When an admin views the Participation list in the Django admin panel, the unsanitized value is rendered directly into the HTML response, causing the injected script to execute in the admin's browser. Commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 23rd percentileScored 2026-11-07
Fix Fixed relate (inducer): 555f0efb1c5bd7531c07cd73724d7e566a81f620

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
inducerrelatebefore 555f0efb1c5bd7531c07cd73724d7e566a81f620555f0efb1c5bd7531c07cd73724d7e566a81f620Patch availableCNA
  • relate Vendorinducer Affected before 555f0efb1c5bd7531c07cd73724d7e566a81f620 Fixed in 555f0efb1c5bd7531c07cd73724d7e566a81f620 Patch available CNA

Remediation

  • Fix · CNA relate (inducer) Fixed in 555f0efb1c5bd7531c07cd73724d7e566a81f620

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42197
  2. 2026-10-25 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-34751 RELATE Vulnerable to Remote Code Execution (RCE) via Insecure Celery Pickle Deserialization CVSS 4.0HIGH 8.7
  • TI-2024-21319 Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1… CVSS 3.1HIGH 7.5
  • TI-2024-21317 Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1… CVSS 3.1MEDIUM 6.0
  • TI-2024-21320 An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary… CVSS 3.1HIGH 8.8
  • TI-2026-30141 RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key() CVSS 3.1CRITICAL 9.0
  • TI-2026-30090 RELATE: Predictable Token Generation in auth.py and exam.py CVSS 3.1HIGH 8.7
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences