CVE-2026-55876

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55876

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55876.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55876

Aliases

GHSA-7r65-76fw-ch5c

Published

2026-10-15T17:23:07Z

Modified

2026-10-16T02:47:59Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts

Details

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55876.json"
}

References

Affected packages

Git / github.com/heliumedu/platform

Affected ranges

Type

GIT

Repo

https://github.com/heliumedu/platform

Events

Introduced

Fixed

f0de5c985c701942758b805a3d11dfb008a6af88

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.2.60"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.1.0

1.1.1

1.10.0

1.10.1

1.10.10

1.10.11

1.10.12

1.10.13

1.10.14

1.10.15

1.10.16

1.10.17

1.10.18

1.10.19

1.10.2

1.10.20

1.10.21

1.10.22

1.10.23

1.10.24

1.10.25

1.10.26

1.10.27

1.10.28

1.10.29

1.10.3

1.10.30

1.10.31

1.10.32

1.10.33

1.10.34

1.10.35

1.10.4

1.10.5

1.10.6

1.10.7

1.10.8

1.10.9

1.11.0

1.11.1

1.11.10

1.11.11

1.11.12

1.11.13

1.11.14

1.11.15

1.11.16

1.11.17

1.11.18

1.11.19

1.11.2

1.11.20

1.11.21

1.11.22

1.11.23

1.11.24

1.11.25

1.11.26

1.11.27

1.11.28

1.11.29

1.11.3

1.11.30

1.11.31

1.11.32

1.11.33

1.11.34

1.11.35

1.11.36

1.11.37

1.11.38

1.11.39

1.11.4

1.11.40

1.11.41

1.11.42

1.11.43

1.11.44

1.11.45

1.11.46

1.11.47

1.11.48

1.11.49

1.11.5

1.11.50

1.11.51

1.11.52

1.11.53

1.11.54

1.11.55

1.11.56

1.11.57

1.11.58

1.11.59

1.11.60

1.11.61

1.11.62

1.11.7

1.11.8

1.11.9

1.12.0

1.12.1

1.12.10

1.12.11

1.12.12

1.12.13

1.12.14

1.12.15

1.12.16

1.12.17

1.12.18

1.12.19

1.12.2

1.12.20

1.12.21

1.12.22

1.12.23

1.12.24

1.12.25

1.12.26

1.12.27

1.12.28

1.12.29

1.12.3

1.12.30

1.12.31

1.12.32

1.12.33

1.12.34

1.12.35

1.12.36

1.12.38

1.12.39

1.12.4

1.12.40

1.12.41

1.12.5

1.12.6

1.12.7

1.12.8

1.12.9

1.13.0

1.13.1

1.13.10

1.13.11

1.13.12

1.13.13

1.13.14

1.13.15

1.13.16

1.13.17

1.13.18

1.13.19

1.13.2

1.13.20

1.13.21

1.13.22

1.13.23

1.13.24

1.13.25

1.13.26

1.13.27

1.13.28

1.13.29

1.13.3

1.13.30

1.13.31

1.13.4

1.13.5

1.13.6

1.13.7

1.13.8

1.13.9

1.14.0

1.14.1

1.14.2

1.14.3

1.14.4

1.14.5

1.14.6

1.14.7

1.15.0

1.15.1

1.15.10

1.15.11

1.15.12

1.15.13

1.15.14

1.15.15

1.15.16

1.15.17

1.15.18

1.15.19

1.15.2

1.15.20

1.15.21

1.15.22

1.15.23

1.15.24

1.15.25

1.15.3

1.15.4

1.15.5

1.15.6

1.15.7

1.15.8

1.15.9

1.16.0

1.16.1

1.16.10

1.16.12

1.16.13

1.16.14

1.16.15

1.16.16

1.16.17

1.16.18

1.16.2

1.16.20

1.16.21

1.16.22

1.16.23

1.16.24

1.16.3

1.16.4

1.16.5

1.16.6

1.16.7

1.16.8

1.16.9

1.17.0

1.17.1

1.17.10

1.17.11

1.17.12

1.17.14

1.17.16

1.17.17

1.17.18

1.17.19

1.17.2

1.17.20

1.17.21

1.17.22

1.17.23

1.17.24

1.17.25

1.17.26

1.17.27

1.17.28

1.17.29

1.17.3

1.17.30

1.17.31

1.17.32

1.17.33

1.17.34

1.17.35

1.17.36

1.17.37

1.17.38

1.17.39

1.17.40

1.17.41

1.17.42

1.17.43

1.17.44

1.17.45

1.17.46

1.17.47

1.17.49

1.17.5

1.17.50

1.17.51

1.17.52

1.17.53

1.17.54

1.17.55

1.17.56

1.17.57

1.17.58

1.17.59

1.17.6

1.17.60

1.17.61

1.17.62

1.17.63

1.17.64

1.17.65

1.17.66

1.17.67

1.17.68

1.17.69

1.17.7

1.17.70

1.17.73

1.17.74

1.17.75

1.17.76

1.17.78

1.17.79

1.17.8

1.17.80

1.17.81

1.17.82

1.17.83

1.17.84

1.17.85

1.17.86

1.17.87

1.17.88

1.17.89

1.17.9

1.17.90

1.18.0

1.18.1

1.18.10

1.18.11

1.18.12

1.18.13

1.18.14

1.18.2

1.18.3

1.18.4

1.18.7

1.18.8

1.18.9

1.2.0

1.2.1

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.4.0

1.4.1

1.4.10

1.4.11

1.4.12

1.4.13

1.4.14

1.4.15

1.4.16

1.4.17

1.4.18

1.4.19

1.4.2

1.4.20

1.4.21

1.4.22

1.4.23

1.4.24

1.4.25

1.4.26

1.4.27

1.4.28

1.4.29

1.4.3

1.4.30

1.4.31

1.4.32

1.4.33

1.4.34

1.4.35

1.4.36

1.4.37

1.4.38

1.4.39

1.4.4

1.4.40

1.4.41

1.4.42

1.4.43

1.4.44

1.4.45

1.4.46

1.4.47

1.4.48

1.4.49

1.4.5

1.4.50

1.4.51

1.4.52

1.4.53

1.4.54

1.4.55

1.4.56

1.4.57

1.4.58

1.4.6

1.4.7

1.4.8

1.4.9

1.5.0

1.5.1

1.5.2

1.5.3

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.7.0

1.7.1

1.7.10

1.7.11

1.7.12

1.7.13

1.7.14

1.7.15

1.7.16

1.7.18

1.7.19

1.7.2

1.7.20

1.7.21

1.7.22

1.7.23

1.7.24

1.7.25

1.7.26

1.7.27

1.7.28

1.7.3

1.7.30

1.7.31

1.7.32

1.7.33

1.7.34

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.9.0

1.9.1

1.9.3

1.9.4

1.9.5

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.5

2.1.0

2.1.1

2.1.10

2.1.100

2.1.101

2.1.102

2.1.103

2.1.104

2.1.105

2.1.106

2.1.107

2.1.108

2.1.109

2.1.11

2.1.110

2.1.111

2.1.112

2.1.113

2.1.114

2.1.116

2.1.117

2.1.118

2.1.119

2.1.12

2.1.120

2.1.121

2.1.122

2.1.123

2.1.124

2.1.125

2.1.126

2.1.127

2.1.128

2.1.129

2.1.13

2.1.130

2.1.131

2.1.132

2.1.133

2.1.134

2.1.135

2.1.136

2.1.137

2.1.138

2.1.139

2.1.14

2.1.140

2.1.141

2.1.142

2.1.143

2.1.144

2.1.145

2.1.146

2.1.147

2.1.148

2.1.149

2.1.15

2.1.150

2.1.151

2.1.152

2.1.153

2.1.154

2.1.155

2.1.156

2.1.157

2.1.158

2.1.159

2.1.16

2.1.160

2.1.161

2.1.162

2.1.163

2.1.164

2.1.165

2.1.166

2.1.167

2.1.168

2.1.169

2.1.17

2.1.170

2.1.171

2.1.172

2.1.173

2.1.174

2.1.175

2.1.176

2.1.177

2.1.178

2.1.179

2.1.18

2.1.180

2.1.181

2.1.182

2.1.183

2.1.184

2.1.185

2.1.186

2.1.187

2.1.188

2.1.189

2.1.19

2.1.190

2.1.191

2.1.192

2.1.193

2.1.194

2.1.195

2.1.196

2.1.197

2.1.198

2.1.199

2.1.2

2.1.20

2.1.200

2.1.201

2.1.202

2.1.203

2.1.204

2.1.205

2.1.206

2.1.207

2.1.208

2.1.209

2.1.21

2.1.210

2.1.211

2.1.212

2.1.213

2.1.214

2.1.215

2.1.216

2.1.217

2.1.218

2.1.219

2.1.22

2.1.221

2.1.222

2.1.223

2.1.224

2.1.225

2.1.226

2.1.227

2.1.228

2.1.229

2.1.230

2.1.231

2.1.232

2.1.233

2.1.234

2.1.235

2.1.236

2.1.237

2.1.238

2.1.239

2.1.24

2.1.240

2.1.241

2.1.242

2.1.243

2.1.25

2.1.26

2.1.27

2.1.28

2.1.29

2.1.3

2.1.30

2.1.31

2.1.32

2.1.33

2.1.34

2.1.35

2.1.36

2.1.37

2.1.38

2.1.39

2.1.4

2.1.40

2.1.41

2.1.42

2.1.43

2.1.44

2.1.45

2.1.46

2.1.47

2.1.48

2.1.49

2.1.5

2.1.50

2.1.51

2.1.52

2.1.53

2.1.54

2.1.55

2.1.56

2.1.57

2.1.58

2.1.59

2.1.6

2.1.60

2.1.61

2.1.62

2.1.63

2.1.64

2.1.65

2.1.66

2.1.67

2.1.68

2.1.69

2.1.7

2.1.70

2.1.71

2.1.72

2.1.73

2.1.74

2.1.75

2.1.76

2.1.77

2.1.78

2.1.79

2.1.8

2.1.80

2.1.81

2.1.82

2.1.83

2.1.84

2.1.85

2.1.86

2.1.87

2.1.88

2.1.89

2.1.9

2.1.90

2.1.91

2.1.92

2.1.93

2.1.94

2.1.95

2.1.96

2.1.97

2.1.98

2.1.99

2.2.0

2.2.1

2.2.10

2.2.11

2.2.12

2.2.13

2.2.15

2.2.16

2.2.17

2.2.18

2.2.19

2.2.2

2.2.20

2.2.21

2.2.22

2.2.23

2.2.25

2.2.26

2.2.27

2.2.28

2.2.29

2.2.3

2.2.30

2.2.31

2.2.32

2.2.33

2.2.34

2.2.35

2.2.36

2.2.37

2.2.38

2.2.39

2.2.4

2.2.40

2.2.41

2.2.42

2.2.43

2.2.44

2.2.45

2.2.46

2.2.47

2.2.48

2.2.49

2.2.5

2.2.50

2.2.51

2.2.52

2.2.53

2.2.54

2.2.55

2.2.56

2.2.57

2.2.58

2.2.59

2.2.6

2.2.7

2.2.8

2.2.9

Other

backup/api-docs-cleanup-pre-rebase

backup/legacy-shutdown-pre-develop-rebase

backup/legacy-shutdown-pre-rebase

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55876.json"