Is CVE-2026-35403 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35403 being exploited in the wild.

How severe is CVE-2026-35403?

Medium severity, with a CVSS score of 6.5, published 8 April 2026.

Which products and versions are affected?

aces Loris >= 15.10, < 27.0.3; 28.0.0.

Is there a fix for CVE-2026-35403?

A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35403 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-35403?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35403: aces LORIS cross-site scripting in survey_accounts module

Q: Which products and versions are affected?

aces Loris >= 15.10, < 27.0.3; 28.0.0.

Q: Is there a fix for CVE-2026-35403?

A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-35403 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-35403?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35403 · Severity: medium · CVSS 6.5 · Published 2026-04-08

LORIS, a web-based platform for managing neuroimaging research data, contains a security flaw in its survey management module. An attacker could trick a researcher or staff member into clicking a malicious link, allowing the attacker to run unauthorized scripts in the victim's browser. This could lead to the theft of sensitive research data or the hijacking of user sessions.

Quick answers

Is CVE-2026-35403 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35403 being exploited in the wild.
How severe is CVE-2026-35403?: Medium severity, with a CVSS score of 6.5, published 8 April 2026.
Which products and versions are affected?: aces Loris >= 15.10, < 27.0.3; 28.0.0.
Is there a fix for CVE-2026-35403?: A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35403 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-35403?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the survey_accounts module of LORIS. The root cause is a failure to set the 'Content-Type: application/json' header in the ValidateEmailSubmitInput.php component. Although the output data is JSON-encoded, the absence of the header causes browsers to perform MIME-sniffing and interpret the payload as HTML. An attacker with low privileges can exploit this by inducing a user to follow a link containing an invalid visit label. This can result in the execution of arbitrary JavaScript in the context of the victim's session. The issue is resolved in versions 27.0.3 and 28.0.1 by explicitly setting the correct JSON Content-Type header.

Affected products

aces Loris >= 15.10, < 27.0.3; 28.0.0

Timeline

2026-04-08: disclosed
2026-04-08: advisory
2026-04-08: patched

References

https://github.com/aces/Loris/security/advisories/GHSA-776p-5pwh-vc8p

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.