Cervantes EUVD-2026-109259

Exploitation requires an authenticated account on the Cervantes instance with permission to write to the 'Notes' field of a Checklist (PR:L), and a second, higher-privileged user must subsequently view that checklist for the stored payload to fire (UI:R). The impact is realized only because the victim holds elevated privileges, so the attack's value depends on a multi-user deployment where low- and high-privilege users share checklists. Limiting factors: it is not exploitable by a fully unauthenticated outsider, it needs victim interaction (viewing the affected note), and a single-user or isolated instance offers no privilege-escalation target.

This is a moderate, authenticated-user XSS issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N, base 6.8) tells a consistent story: network-reachable, low attack complexity, but it REQUIRES an existing low-privileged authenticated account (PR:L) to inject the payload AND a victim to view the malicious Notes field (UI:R). The scope change (S:C) plus C:H reflects the real danger - a stored payload executing in a higher-privileged user's (e.g. admin/project-owner) browser session, enabling session or privilege theft 'with elevated privileges' as the description states. No EPSS score, KEV listing, or verified proof-of-concept was provided, so there is no evidence of active or at-scale exploitation; the vuln.today decision label is 'this_month,' not act_now or emergency, which aligns with a patch-on-normal-cadence posture. The 'RCE' tag in the input is misleading: the description describes arbitrary code execution in another user's BROWSER (client-side script), not server-side remote code execution - treat this as stored XSS, not RCE. Overall a real but bounded risk requiring an insider or a compromised low-priv account plus victim interaction.

A low-privileged user (or attacker controlling such an account) on a shared Cervantes pentest-collaboration instance stores a malicious script in the 'Notes' field of a Checklist. When a higher-privileged teammate (e.g. an administrator or project owner) later opens that checklist, the script executes in their browser session with their elevated privileges, allowing session hijacking or actions on their behalf. No verified public exploit code was identified in the provided data, though the injection is straightforward given AC:L.