Is there a patch available for EUVD-2026-78674?

Yes, a patch is available for EUVD-2026-78674. Update the affected software to the latest version immediately.

Kiwi TCMS EUVD-2026-78674

| CVE-2026-55630 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-07-06 https://github.com/kiwitcms/Kiwi

GHSA-473p-56xx-vg67 PYSEC-2026-2551

XSS Docker

Severity by source

vuln.today AI

5.4 MEDIUM

Stored XSS requires authenticated write access (PR:L), victim page view (UI:R), scope change to victim browser (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Sep 15, 2026 - 17:18 EUVD

Analysis Generated

Jul 06, 2026 - 22:43 vuln.today

DescriptionCVE.org

Summary

In Kiwi TCMS the fields TestCase.extra_link and TestPlan.extra_link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value.

Impact

Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a Content-Security-Policy header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.

AnalysisAI

Stored cross-site scripting in Kiwi TCMS versions prior to 16.1 allows authenticated users to inject arbitrary JavaScript into the TestCase.extra_link and TestPlan.extra_link fields, which are rendered verbatim to all subsequent viewers. Official Docker-based deployments are substantially protected by a Content-Security-Policy header that blocks inline script execution, but customized deployments that alter default middleware or security settings remain fully exploitable. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

Kiwi TCMS is an open-source test case management system distributed as a Python pip package (pkg:pip/kiwitcms) and as official Docker images. The extra_link fields on TestCase and TestPlan model objects were designed to hold URLs to external resources but accepted arbitrary string input without sanitization, storing and later rendering attacker-controlled values directly in the browser - a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS pattern. The Django-based application's official deployment stack sends a Content-Security-Policy response header that restricts inline JavaScript execution, functioning as a meaningful defense-in-depth control. Deployments that customize or strip this middleware lose that protection entirely.

RemediationAI

Upgrade to Kiwi TCMS 16.1, available at https://github.com/kiwitcms/Kiwi/releases/tag/v16.1. Note that the 16.1 release explicitly resets any existing database records where extra_link values fail the new validation to null - operators should communicate this data-loss side effect to users before upgrading. For deployments that cannot immediately upgrade, ensure the default Content-Security-Policy middleware is active and unmodified; this header blocks inline script execution and substantially limits exploitability. Disabling or weakening CSP to accommodate third-party integrations removes this control and increases exposure. Restricting write access to TestCase and TestPlan objects to trusted users only is an additional compensating control, though it affects intended workflow.