Cross-Site Scripting Vulnerability in kagisearch smallweb Product

CVE-2026-90583

What is CVE-2026-90583?

A security flaw has been identified in the kagisearch smallweb product that affects the indexing functionality within the Query String Rendering component. This flaw enables cross-site scripting attacks that can be executed remotely. Attackers can exploit this vulnerability by manipulating the 'qs' argument, resulting in the execution of malicious scripts. Notably, the exploit can be launched using raw HTTP requests containing unencoded double-quote characters in the query string, as typical web browsers encode such characters. To mitigate this risk, users are urged to apply the designated patch promptly.

References