CVE-2026-105410 in Tuleap Enterprise Edition
Summary
by MITRE • 10/12/2026
A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The identified security flaw represents a classic instance of stored cross-site scripting, specifically categorized under CWE-79 within the Common Weakness Enumeration framework. This vulnerability impacts Tuleap Enterprise Edition versions ranging from 17.0 through 17.5 and stems from insufficient sanitization or validation of user-supplied input before it is persistently stored on the server side. Unlike reflected XSS, where malicious scripts are executed immediately via a crafted link, this variant allows an attacker to embed harmful JavaScript code into data fields that are subsequently retrieved and rendered by other users' browsers without further modification. The persistence of the payload means that every user who views the compromised content becomes a potential victim, significantly amplifying the blast radius of the exploit compared to transient injection flaws.
From an operational perspective, this vulnerability enables attackers to execute arbitrary script code within the context of the affected application's domain in the victim's browser session. This capability allows for severe security compromises including session hijacking, where the attacker steals authentication cookies or tokens to impersonate legitimate users. It also facilitates credential harvesting by injecting fake login forms that capture usernames and passwords when victims attempt to authenticate. Furthermore, attackers can perform actions on behalf of the user, such as modifying project settings, creating new projects, or deleting existing data, thereby undermining the integrity and confidentiality of collaborative development environments managed by Tuleap. The attack aligns with MITRE ATT&CK technique T1059.007, which covers JavaScript execution in web browsers, often used for initial access or persistence depending on how the payload is structured.
The root cause typically involves a failure to properly neutralize special characters that have meaning within HTML and JavaScript contexts when storing user input into databases or file systems. When this tainted data is later retrieved and displayed by other users' clients, the browser interprets the embedded scripts as legitimate code belonging to the application's origin. This bypasses same-origin policy protections because the malicious script originates from a trusted domain. The vulnerability highlights critical gaps in input validation strategies, particularly regarding context-aware encoding that should be applied both at ingestion points and during output rendering phases to ensure data integrity across all user interactions.
Mitigation requires immediate patching of Tuleap Enterprise Edition to version 17.6 or later where the issue has been resolved by developers through rigorous code review and enhanced input sanitization routines. In addition to upgrading, organizations should implement strict Content Security Policy headers that restrict script execution sources, thereby limiting the impact even if an injection occurs. Input validation mechanisms must be strengthened to reject any non-alphanumeric characters in fields not explicitly designed for rich text or HTML content. For areas requiring such functionality, developers must employ context-sensitive output encoding rather than relying solely on input filtering. Regular security audits and static application security testing should also be integrated into the development lifecycle to detect similar weaknesses before deployment.