CVE-2026-129154 in SurveyKing
Summary
by MITRE • 11/13/2026
SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a respondent-supplied survey snapshot and the frontend renders its titles via innerHTML. Anonymous respondents can submit a forged snapshot embedding event handlers such as img onerror that execute in an administrator's browser session when the response is viewed.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
SurveyKing versions 1.13.0 through 1.13.2 are affected by a critical stored cross-site scripting vulnerability rooted in improper input validation and unsafe DOM manipulation practices within the application architecture. The core technical flaw lies in how the server processes survey snapshots submitted by respondents. When an anonymous user submits a snapshot, the backend accepts this data without adequately sanitizing embedded script content or event handlers. This insecure handling allows attackers to inject malicious payloads directly into the stored data structure of the survey system rather than merely passing them through transient request parameters.
The exploitation mechanism relies on the frontend application's rendering logic for displaying these snapshots. Specifically, the interface utilizes innerHTML to render titles and other dynamic elements derived from the submitted snapshot data. By using innerHTML instead of safer alternatives like textContent or proper DOM escaping methods, the browser interprets any HTML tags present in the input as executable code rather than plain text. This architectural decision creates a direct pathway for script execution whenever the vulnerable content is rendered within the user's browser context.
The operational impact of this vulnerability is severe due to its stored nature and the potential target audience. An attacker, acting as an anonymous respondent, can craft a malicious survey snapshot containing embedded event handlers such as img onerror or other JavaScript triggers. When an administrator views the responses associated with this forged snapshot, their browser automatically executes the injected script within the context of the administrative session. This bypasses same-origin policy protections because the code runs from the application's own domain, granting the attacker full access to all cookies, local storage data, and session tokens held by the administrator's browser.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a common cause for cross-site scripting flaws. Furthermore, from an offensive security perspective mapped against the MITRE ATT&CK framework, this exploit technique corresponds to T1059 Command and Scripting Interpreter via browser-based execution or potentially T1213 Data from Information Repositories if used in conjunction with other techniques to exfiltrate data stored within the survey platform. The ability for anonymous users to affect privileged accounts significantly elevates the risk profile, as it removes authentication barriers that typically mitigate such attacks.
To mitigate this vulnerability, immediate remediation is required by updating SurveyKing to a patched version where these input validation and output encoding issues have been addressed. In the interim, administrators should enforce strict Content Security Policy headers that restrict inline script execution, thereby neutralizing payloads embedded via innerHTML even if they are successfully stored in the database. Additionally, developers must refactor the frontend code to avoid using innerHTML for rendering untrusted data, opting instead for methods that treat input as text rather than executable markup. Input validation on the server side should also be strengthened to reject or sanitize any HTML tags and event handlers before storage occurs.