Cross-Site Scripting in SuiteCRM: Open-Source CRM Software Vulnerability
CVE-2026-29106
What is CVE-2026-29106?
SuiteCRM, an open-source customer relationship management platform, is susceptible to a Cross-Site Scripting (XSS) vulnerability wherein the return_id request parameter is improperly handled. Specifically, prior to versions 7.15.1 and 8.9.3, this parameter is directly incorporated into an HTML tag attribute that acts as an event handler, enabling potential exploitation by attackers. It's crucial for users to upgrade to fixed versions and implement a Content Security Policy (CSP) header to effectively safeguard against XSS attacks.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
SuiteCRM < 7.15.1 < 7.15.1
SuiteCRM >= 8.0.0, < 8.9.3 < 8.0.0, 8.9.3