kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf Query String Rendering app/sw.py index qs cross site scripting

Summaryinfo

A vulnerability labeled as problematic has been found in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The impacted element is the function index of the file app/sw.py of the component Query String Rendering. Executing a manipulation of the argument qs can lead to cross site scripting. This vulnerability appears as CVE-2026-90583. The attack may be performed from remote. There is no available exploit. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. Applying a patch is advised to resolve this issue. Exploitability requires a raw HTTP request carrying unencoded double-quote characters in the query string - Werkzeug's request.query_string returns the raw request-target, and ordinary browsers percent-encode " as %22, so the payload only lands via netcat/curl-style raw sockets.

Detailsinfo

A vulnerability has been found in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf and classified as problematic. This vulnerability affects the function index of the file app/sw.py of the component Query String Rendering. The manipulation of the argument qs with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-90583. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Exploitability requires a raw HTTP request carrying unencoded double-quote characters in the query string - Werkzeug's request.query_string returns the raw request-target, and ordinary browsers percent-encode " as %22, so the payload only lands via netcat/curl-style raw sockets.

Applying the patch 00b68144e583f20a6b67e29cf01bc07f57979ffb is able to eliminate this problem. The bugfix is ready for download at github.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• kagisearch

Name

• smallweb

Version

• 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf

License

• open-source

Website

• Product: https://github.com/kagisearch/smallweb/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #913779: kagisearch smallweb main Cross Site Scripting (by Customeres)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion