Executive brief
Taiga is a project management platform used by developers to track agile workflows. A security flaw in the web interface allows malicious code to be stored within the platform, which could then be executed in the browsers of other users. This could allow an attacker to steal sensitive session information or perform actions on behalf of legitimate users.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the Taiga front-end component due to improper neutralization of user-controllable input. Specifically, the 'ConfirmService' component used a 'textToHTML' filter and the jQuery '.html()' method to render message content, allowing arbitrary HTML and script execution. An attacker with low privileges can inject a malicious payload that triggers when a victim interacts with a confirmation dialog. The vulnerability is addressed in version 6.9.1 by switching to the '.text()' method for rendering these messages, ensuring input is treated as literal text rather than executable code.
Affected products
- Taiga taiga-front < 6.9.1
Timeline
- 2026-04-24: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix released in version 6.9.1