Helium Platform EUVD-2026-102221

Exploitation requires (1) an authenticated account permitted to use the POST /planner/attachments/ endpoint, and (2) a victim to actively open the resulting public attachment URL. The specific technical prerequisite is that the uploaded SVG is served with the image/svg+xml content type (or HTML served as text/html), which conf/configs/common.py failed to list in BLOCKED_ATTACHMENT_EXTENSIONS / BLOCKED_ATTACHMENT_MIME_TYPES prior to 2.2.60. A critical LIMITING factor is that attachments are served from a SEPARATE ORIGIN from the application, so the same-origin policy blocks the script from reading application cookies, tokens, or storage - restricting realistic impact to phishing and persistent spoofed content rather than session or account compromise. Affected versions are those prior to 2.2.60.

This is a genuinely low-priority issue despite being network-reachable. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) scores 3.5 (Low), and the signals are internally consistent rather than conflicting: network vector but requires authentication (PR:L) to upload the attachment, and victim interaction (UI:R) to open the malicious public URL. The most important risk-limiting signal comes from the description itself, not the vector: the attachment storage uses a SEPARATE ORIGIN from the application, so the same-origin policy prevents the injected SVG/HTML script from reading application cookies or storage - meaning this is NOT a classic session-stealing stored XSS, and the maintainer explicitly states application-session compromise is not supported by the deployment configuration. Impact is therefore confined to persistent attacker-controlled active content and phishing served under a trusted-looking application-managed URL (hence C:N, I:L, A:N). No EPSS score was provided in the input, and KEV status is NO and POC status is not indicated - there is no public exploit identified at time of analysis. Net: a real but low-severity hygiene/phishing-surface issue, not an urgent remote-code or credential-theft threat.

An authenticated Helium user uploads a crafted SVG (served as image/svg+xml) or HTML file as a planner attachment, which the blocklist in conf/configs/common.py fails to reject. The attacker then distributes the public attachment URL; when a visitor opens it, the embedded script executes in the attachment-origin context, enabling convincing phishing under an application-managed storage URL. No public exploit code was identified in the input, though the fix commit (f0de5c98) makes the vulnerable code path straightforward to reconstruct.