Read the docs
TI-2026-74873 Aliases CVE-2026-55876

Stored cross-site scripting in Helium via uploaded SVG attachments

Priority MEDIUM 50CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Helium before 2.2.60 lets authenticated users upload SVG and HTML attachments. An uploaded SVG served as image/svg+xml runs embedded script when a visitor opens its public attachment URL (CWE-79). Attackers can store active content and phishing pages under an application-managed storage URL. The separate attachment origin keeps the script from reading application cookies or storage.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00184 8th percentileScored 2026-11-07
Fix Fixed platform (HeliumEdu): 2.2.60

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HeliumEduplatformbefore 2.2.602.2.60Patch availableCNA
  • platform VendorHeliumEdu Affected before 2.2.60 Fixed in 2.2.60 Patch available CNA

Remediation

Upgrade the Helium platform to version 2.2.60, which contains the fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA platform (HeliumEdu) Fixed in 2.2.60

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-55876
  2. 2026-10-21 CISA SSVC decision points changed
  3. 2026-10-21 Priority changed: LOW → MEDIUM

References

Other 2

  • TI-2026-74872 Server-side request forgery in Helium external calendar feed CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences