# CVE-2026-105456: RT for Incident Response HTML scrubber XSS via javascript: link

Source: https://junglewise.ai/threats/cve-2026-105456-rtir-extends-rt-s-html-scrubber-to-allow-an-internal-link  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-105456 · Severity: info · Published 2026-10-30

RT for Incident Response (RTIR) is a ticketing system used by security teams to manage incident reports and responses. A flaw in RTIR's HTML content filtering allows attackers to inject malicious links using the javascript: scheme, which execute when users click them. An unauthenticated attacker can plant such links by sending HTML email to the Incident Reports queue, and the scripts run in the victim's session with their full RT permissions.

Vendors: [Best Practical Solutions](https://junglewise.ai/threats/vendors/best-practical-solutions).

## Quick answers

**Is CVE-2026-105456 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105456 being exploited in the wild.

**How severe is CVE-2026-105456?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Best Practical Solutions RT for Incident Response 5.0.0 to 5.0.10, 6.0.0 to 6.0.3.

**Is there a fix for CVE-2026-105456?** Yes: fixed in RT for Incident Response 5.0.11 and 6.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105456 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105456?** Check whether you run Best Practical Solutions RT for Incident Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in RT for Incident Response 5.0.11 and 6.0.4

## Technical details

RTIR extends RT's HTML scrubber to permit internal link placeholders, but the implementation allows any link containing the placeholder through unfiltered—including javascript: scheme URLs. The vulnerability affects the entire RT instance where RTIR is installed, not just RTIR queues. An unauthenticated sender can inject malicious HTML via email to the default public Incident Reports queue, and the script executes in the browser session of any user who views or interacts with the ticket, enabling account compromise or malicious actions within RT.

## Affected products

- Best Practical Solutions RT for Incident Response 5.0.0 to 5.0.10, 6.0.0 to 6.0.3

## Timeline

- 2026-10-30: disclosed

## References

- [https://cert.pl/en/posts/2026/10/CVE-2026-105454](https://cert.pl/en/posts/2026/10/CVE-2026-105454)
- [https://requesttracker.com/rtir/](https://requesttracker.com/rtir/)

## Related threats

- [Best Practical Solutions RT for Incident Response reflected XSS in ticket forms](https://junglewise.ai/threats/cve-2026-105455-rtir-s-ticket-creation-forms-show-the-subject-of-the-related)