Executive brief
Request Tracker (RT), an enterprise-grade ticket tracking system, contains a vulnerability that allows users to inject malicious scripts into the platform. An authenticated user could save specially crafted data that, when viewed by another staff member or administrator, executes unauthorized code in their browser. This could lead to the theft of session information or unauthorized actions being performed on behalf of the victim.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in RT 6.0.x due to improper neutralization of user-controllable input during web page generation (CWE-79). Specifically, user-controlled data is rendered within templates without proper HTML escaping. An authenticated attacker with permissions to modify ticket data or other relevant fields can inject a JavaScript payload. This payload is then executed in the context of any user (including administrators) who navigates to the affected page. The vulnerability is addressed in version 6.0.3 by implementing proper output encoding.
Affected products
- Best Practical RT >= 6.0.0, < 6.0.3
Timeline
- 2026-05-20: patched: RT version 6.0.3 released
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date