What is the CVSS score of CVE-2026-42197?

CVE-2026-42197 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-42197?

RELATE courseware is vulnerable to a privilege escalation attack allowing enrolled students to inject malicious code that executes in administrator sessions, resulting in complete admin account…. A patch is available.

How to fix or mitigate CVE-2026-42197?

Within 24 hours: Identify all RELATE instances in use; review administrator activity logs for participation list access patterns and anomalies for evidence of exploitation. Within 7 days: Implement compensating controls (input validation, CSP headers, profile field restrictions) to block injection vectors; notify affected administrators of exposure risk. Within 30 days: Apply vendor-released patch once available; conduct security testing to confirm fix effectiveness before full production deployment.

Python CVE-2026-42197

EUVD-2026-32627 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 GitHub_M

XSS Python

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 27, 2026 - 21:04 EUVD

Source Code Evidence Fetched

May 27, 2026 - 20:28 vuln.today

Analysis Generated

May 27, 2026 - 20:28 vuln.today

DescriptionGitHub Advisory

RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session, potentially leading to full admin account takeover. The get_user() method in ParticipationAdmin renders user-controlled input using mark_safe combined with Python's % string formatting. This bypasses Django\'s automatic HTML escaping entirely. The value returned by get_full_name is derived directly from the first_name and last_name fields of the User model. These fields are freely editable by any authenticated user through the profile page (/profile/) with no sanitization applied. When an admin views the Participation list in the Django admin panel, the unsanitized value is rendered directly into the HTML response, causing the injected script to execute in the admin's browser. Commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 fixes the issue.

AnalysisAI

Stored cross-site scripting in the RELATE web courseware lets any enrolled student inject JavaScript that executes in an administrator's authenticated browser session, enabling full admin account takeover. The payload is planted via the freely editable first_name/last_name fields on the /profile/ page and fires when an admin opens the Participation list in the Django admin panel. No public exploit has been identified, but the root cause is confirmed in source and fixed upstream; with a CVSS of 8.7 and a scope-changing impact, this is a high-severity privilege-escalation issue.