Cross-Site Scripting in the YouMind web application via SVG avatar
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The YouMind web application has a cross-site scripting flaw in its avatar update endpoint. The application does not sanitise or validate SVG content, so an SVG image with embedded JavaScript can be set as a profile picture. CWE-79 describes this weakness. A remote attacker with low privileges can have a victim open the crafted image, and the script then runs in the context of the CDN domain that serves the file.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade the YouMind web application to 13/10/2026, the fixed version. Versions before 13/10/2026 are affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
- Fix · CNA YouMind web application (YouMind) Fixed in 13/10/2026
Timeline
- 2026-10-13 Threatist record created from CVE-2026-96535
- 2026-10-13 Alias added: GHSA-mrvg-xhq8-v864
- 2026-10-16 CISA SSVC decision points changed
References
Sources
- CVE-2026-96535 · CVE Program
- CVE-2026-96535 · NVD
- FIRST EPSS
- GHSA-mrvg-xhq8-v864 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences