TI-2026-86162 Aliases CVE-2026-71881 GHSA-xcpx-4ghq-5cp2

Cross-site scripting in GBIF Integrated Publishing Toolkit

LOW 22CWE-79Published 2026-11-06 · Updated 2026-11-06

Key facts

Attack vector: Network
Privileges required: High
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

GBIF Integrated Publishing Toolkit versions from 0 before 3.3.5 are affected. Input in resource metadata fields is not neutralized before it is rendered, which is a stored cross-site scripting flaw (CWE-79). An authenticated remote attacker with high privileges can run script in another user's session after that user interacts with the affected content.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting

Why it matters now

EPSS 0.00415 36th percentileScored 2026-11-07

Fix Fixed Integrated Publishing Toolkit (GBIF): 3.3.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GBIF	Integrated Publishing Toolkit	before 3.3.5	3.3.5	Patch available	CNA

Integrated Publishing Toolkit VendorGBIF Affected before 3.3.5 Fixed in 3.3.5 Patch available CNA

Remediation

Upgrade GBIF Integrated Publishing Toolkit to version 3.3.5 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Fix · CNA Integrated Publishing Toolkit (GBIF) Fixed in 3.3.5

Timeline

2026-11-06 Threatist record created from CVE-2026-71881
2026-11-07 Alias added: GHSA-xcpx-4ghq-5cp2

References

Patch 1

https://github.com/gbif/ipt/issues/3166

Advisory 1

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0017.md

TI-2026-50194 Authentication bypass in Integrated Publishing Toolkit CVSS 4.0CRITICAL 9.1
TI-2026-50193 Authentication bypass in Integrated Publishing Toolkit CVSS 4.0CRITICAL 9.2
TI-2026-50195 Server-side template injection in Integrated Publishing Toolkit CVSS 4.0HIGH 7.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences