Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

SHIRASAGI lets attackers run scripts in visitors' browsers

CVE-2026-81635 · published 1 month ago
Summary

The SHIRASAGI web platform can be tricked into inserting malicious code into pages, causing a visitor's browser to run unwanted scripts. This could let attackers steal information or change what the user sees. Apply any available updates or patches from the project and ensure that input from users is properly cleaned.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
shirasagi project shirasagi <= v1.20.2
Original advisory text
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published10 Sep 2026
Updated4 Nov 2026
First seen10 Sep 2026
Sources
CVE-2026-81635 · NVD
CVE-2026-81635 · MITRE
Track software like this
Free during beta