CVE-2026-54049

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54049
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54049.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54049
Aliases
Published
2026-10-01T19:42:50Z
Modified
2026-10-04T02:30:22Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Sakai Conversations has a Stored XSS Issue
Details

Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML() directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post. This issue has been patched in versions 23.5, 25.3, and 26.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54049.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "25.0"
                },
                {
                    "fixed":  "25.3"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/sakaiproject/sakai

Affected ranges

Type
GIT
Repo
https://github.com/sakaiproject/sakai
Events
Introduced
5d29a6077bcf22c8a9d2860fd655d7caecf3ab43
Fixed
1947ba90029ebc72f1a9ad98ce9832cb8733fb48
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "23.0"
        },
        {
            "fixed":  "23.5"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

23.*
23.0
23.1
23.2
23.3
23.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54049.json"