# CVE-2026-105291: FeelCRM Department Search reflected XSS in keyword parameter

Source: https://junglewise.ai/threats/cve-2026-105291-a-vulnerability-was-identified-in-feelec-yishu-feelcrm-os-1-0-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105291 · Severity: medium · CVSS 4.3 · Published 2026-10-05

FeelCRM is an open-source customer relationship management system used by small to medium enterprises for managing leads, customers, and contracts. A reflected cross-site scripting vulnerability in the department search feature allows an attacker to inject malicious JavaScript code via a crafted URL, which executes in the browser of an authenticated user who clicks the link. An attacker can steal session data, modify CRM records, or perform unauthorized actions within the victim's permissions.

Vendors: [Feelec-Yishu](https://junglewise.ai/threats/vendors/feelec-yishu).

## Quick answers

**Is CVE-2026-105291 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105291 being exploited in the wild.

**How severe is CVE-2026-105291?** Medium severity, with a CVSS score of 4.3, published 5 October 2026.

**Which products and versions are affected?** Feelec-Yishu FeelCRM 1.0.0.

**Is there a fix for CVE-2026-105291?** No fixed version is recorded yet. Apply HTML attribute encoding using htmlspecialchars($keyword, ENT_QUOTES, 'UTF-8') at the output sink in the template. Implement a restrictive Content Security Policy to block inline event handlers as defense in depth.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-14"},{"kind":"advisory","at":"2026-10-05"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105291 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105291?** Check whether you run Feelec-Yishu FeelCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Apply HTML attribute encoding using htmlspecialchars($keyword, ENT_QUOTES, 'UTF-8') at the output sink in the template. Implement a restrictive Content Security Policy to block inline event handlers as defense in depth.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-14"},{"kind":"advisory","at":"2026-10-05"}]

## Technical details

The GroupController::index function receives the keyword parameter from $_GET without HTML encoding and passes it directly to the template, where it is inserted into a double-quoted HTML attribute value without context-aware encoding. An attacker can break out of the attribute using a double quote and inject an img tag with an onerror event handler. The vulnerability requires the victim to be authenticated and click a malicious link; the attack is network-based and reflected (not stored).

## Affected products

- feelec-yishu FeelCRM 1.0.0

## References

- [https://github.com/feelec-yishu/feelcrm-os/](https://github.com/feelec-yishu/feelcrm-os/)
- [https://github.com/feelec-yishu/feelcrm-os/issues/5](https://github.com/feelec-yishu/feelcrm-os/issues/5)