inducer relate /profile/ get_user cross site scripting

Summaryinfo

A vulnerability classified as problematic has been found in inducer relate. The impacted element is the function get_user of the file /profile/. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2026-42197. Remote exploitation of the attack is possible. No exploit is available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in inducer relate (version now known). It has been declared as problematic. Affected by this vulnerability is the function get_user of the file /profile/. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session, potentially leading to full admin account takeover. The `get_user()` method in `ParticipationAdmin` renders user-controlled input using `mark_safe` combined with Python's % string formatting. This bypasses Django\'s automatic HTML escaping entirely. The value returned by `get_full_name` is derived directly from the `first_name` and `last_name` fields of the User model. These fields are freely editable by any authenticated user through the profile page (`/profile/`) with no sanitization applied. When an admin views the Participation list in the Django admin panel, the unsanitized value is rendered directly into the HTML response, causing the injected script to execute in the admin's browser. Commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 fixes the issue.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-42197 since 04/25/2026. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Applying the patch 555f0efb1c5bd7531c07cd73724d7e566a81f620 is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• inducer

Name

• relate

Website

• Product: https://github.com/inducer/relate/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion