JavaScript Injection Vulnerability in LimeSurvey Community Edition 7.4.0
CVE-2026-102626

7.2HIGH

Key Information:

Vendor

Limesurvey

Status
Limesurvey
Vendor
CVE Published:
2 October 2026

What is CVE-2026-102626?

An authenticated user in LimeSurvey Community Edition 7.4.0 with the 'Surveys: create' permission is able to insert a malicious JavaScript-breaking value into the 'date_min' attribute of a Date/Time question. When another user views this question, LimeSurvey improperly renders the stored value as a single-quoted inline JavaScript literal without appropriate JavaScript-context encoding, leading to potential cross-site scripting (XSS) vulnerabilities.

Affected Version(s)

LimeSurvey Windows 7.4.0

References

https://fluidattacks.com/advisories/golden
third-party-advisory
https://github.com/LimeSurvey/LimeSurvey/
product
https://github.com/LimeSurvey/LimeSurvey/commit/32e54f14f...
patch

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Miguel GĂłmez
Fluid Attacks' AI SAST Scanner
.