Executive brief
MyEMS, an open-source energy management system, contains a security flaw in its administrative backend. An attacker with administrative privileges can upload malicious SVG files that execute scripts in the browsers of other users, including other administrators. This could lead to the theft of session cookies and full account takeover of any user who views the malicious content.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in MyEMS versions up to 6.4.0. The flaw is located in the 'on_post' function within 'myems-api/core/svg.py', which handles SVG code uploads for the Admin Backend. The application fails to perform content security filtering on the 'source_code' field within the 'new_values['data']' argument, allowing an attacker to inject malicious JavaScript (e.g., via <foreignObject> or <iframe> tags). While the attack requires administrative privileges to upload the payload, the resulting script executes in the context of any user (admin or regular) who views the SVG via the preview or auxiliary system functions. This can lead to session cookie theft and account takeover. The issue is fixed in version 6.5.0 by implementing input sanitization.
Affected products
- MyEMS MyEMS up to 6.4.0
Timeline
- 2026-06-09: disclosed: Issue reported on GitHub
- 2026-05-26: patched: Version 6.5.0 released with fix
- 2026-07-10: advisory: CVE published