Bugsink
CVE-2026-27614
CRITICAL
GHSA-vp6q-7m36-pq3w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted event with JavaScript payload
-
ExploitTrigger Pygments heredoc parsing quirk
-
ExecutionRaw input bypasses sanitization
-
ImpactExecute JavaScript in victim's browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Unauthenticated attacker must have network access to Bugsink project event submission endpoint. Victim user must explicitly view the affected Stacktrace in Bugsink web UI. Default Bugsink installations with public or accessible event ingestion. |
| Impact | CVSS 9.3. Error tracking tools are viewed by developers — XSS can steal developer session tokens or inject malicious code into development workflows. |
| Exploit ScenarioDerived | Attacker submits crafted error event containing XSS payload, developer views the error in Bugsink dashboard, attacker's JavaScript executes and steals developer session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Stored XSS in Bugsink error tracking tool before 2.0.13 allows unauthenticated attackers to inject persistent scripts through error event submissions. PoC and patch available.
Earlier versions of this analysis (1)
Unauthenticated stored XSS in Bugsink error tracking.
RemediationAI
Update to Bugsink 2.0.13. Sanitize all error event data before rendering.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-79 stored XSS. Error events submitted to Bugsink can contain JavaScript that executes when developers view the error in the dashboard.
Know when Bugsink gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can submit events to a Bugsink project can store arbitrary JavaScript in an event. The payload executes only if a user explicitly views the affected Stacktrace in the web UI. When Pygments returns more lines than it was given (a known upstream quirk that triggers with Ruby heredoc-style input), _pygmentize_lines() in theme/templatetags/issues.py:75-77 falls back to returning the raw input lines. mark_safe() at line 111-113 is then applied unconditionally - including to those unsanitized raw lines. Since DSN endpoints are public by Sentry protocol, no account is needed to inject. The payload sits in the database until an admin looks at the event. Successful exploitation requires that the attacker to be able to submit events to the project (i.e. knows the DSN or can access a client that uses it), the Bugsink ingest endpoint is reachable to the attacker, and an administrator explicitly views the crafted event in the UI. Under those conditions, the attacker can execute JavaScript in the administrator’s browser and act with that user’s privileges within Bugsink. Version 2.0.13 fixes the vulnerability.
Executive ViewAI
Bugsink deployments running versions prior to 2.0.13 are exposed to unauthenticated remote code execution via malicious event submissions, allowing attackers to inject and execute arbitrary JavaScript within your error tracking environment. This vulnerability affects any organization using self-hosted Bugsink without immediate remediation, potentially compromising data confidentiality, system integrity, and operational continuity.
Apply vendor patch. If immediate patching is not possible, implement network segmentation to restrict unauthenticated access to Bugsink event submission endpoints, deploy WAF rules to block suspicious JavaScript payloads in event submissions, disable public event submission APIs, and enforce authentication on all event ingestion endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Authenticated arbitrary file write in Bugsink 2.1.0 allows remote attackers to write malicious content to filesystem loc
Ingestion denial of service in Bugsink affects self-hosted instances running versions 2.2.1 and earlier, where any calle
Cross-project sourcemap and debug-file disclosure in Bugsink prior to 2.2.0 allows an authenticated user with access to
Cross-project issue state modification in Bugsink prior to 2.2.0 allows authenticated users with access to one project t
Cross-project event data exposure in Bugsink prior to 2.2.0 allows an authenticated user with access to one project to r
Exploit-DB