【低危】kiwitcms：跨站脚本风险（GHSA-473p-56xx-vg67）

安全情报快照 · 风险级别：低危 · CVE-2026-55630 · GHSA-473p-56xx-vg67

先看结论

kiwitcms存在跨站脚本风险，<= 12.4 受影响。上游暂未提供明确修复版本。

影响范围

生态	组件	受影响版本	首个修复版本
pip	`kiwitcms`	<= 12.4	—

处置建议

上游公告暂未给出明确修复版本。请持续关注项目维护者发布的补丁，并结合受影响版本范围排查资产。

上游技术详情（原文）

Summary

In Kiwi TCMS the fields TestCase.extra_link and TestPlan.extra_link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value.

Impact

Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a Content-Security-Policy header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。