TI-2026-40157 Aliases CVE-2026-55630 GHSA-473p-56xx-vg67

Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)

LOW 3CWE-79Published 2026-09-15 · Updated 2026-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a Content-Security-Policy header that blocks inline JavaScript, making exploitation difficult in default deployments, while customized deployments that weaken those security settings may remain vulnerable. Version 16.1 properly sanitizes both fields and resets existing database records that do not validate to null. This issue is fixed in version 16.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0042 36th percentileScored 2026-11-07

Fix Fixed Kiwi (kiwitcms): 16.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kiwitcms	Kiwi	before 16.1	16.1	Patch available	CNA
—	kiwitcms (PyPI)	up to 12.4	—	No fix listed	GHSA-473p-56xx-vg67

Kiwi Vendorkiwitcms Affected before 16.1 Fixed in 16.1 Patch available CNA
kiwitcms (PyPI) Vendor— Affected up to 12.4 Fixed in — No fix listed GHSA-473p-56xx-vg67

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:kiwitcms:kiwi_tcms::::::::	—	—	kiwitcms

cpe:2.3:a:kiwitcms:kiwi_tcms:*:*:*:*:*:*:*:* Versions — — ·kiwitcms

Remediation

Fix · CNA Kiwi (kiwitcms) Fixed in 16.1

Timeline

2026-10-02 Threatist record created from CVE-2026-55630
2026-10-03 Alias added: GHSA-473p-56xx-vg67

References

Other 6

TI-2023-14429 Kiwi TCMS unrestricted file upload vulnerability CVSS 3.1CRITICAL 9.0
TI-2023-14444 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow CVSS 3.1HIGH 8.8
TI-2023-18603 Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox CVSS 3.1HIGH 8.1
TI-2023-16845 Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS CVSS 3.1HIGH 8.1
TI-2022-03753 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi CVSS 3.1MEDIUM 5.4
TI-2023-14379 Kiwi TCMS may allow user to update email address to unverified one CVSS 3.1MEDIUM 4.3

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences