Cross-Site Scripting Vulnerability in Kiwi TCMS Test Management System

CVE-2026-55630

What is CVE-2026-55630?

Kiwi TCMS, an open-source test management system, had a vulnerability where the TestCase.extra_link and TestPlan.extra_link fields allowed unsanitized user input to be stored and rendered. This created a route for cross-site scripting attacks. However, the provided official Docker images and the default configuration of Kiwi TCMS include a Content-Security-Policy header that helps mitigate the risk by blocking inline JavaScript. It is important to note that customized deployments altering these security settings may be at risk. The issue was addressed in version 16.1, which introduced proper sanitation procedures for the affected fields and reset any non-compliant database entries to null.

References