Executive brief
Squirro Cognitive Search is an enterprise search platform that helps organizations find and analyze information across multiple data sources. A stored cross-site scripting (XSS) vulnerability in email notification templates, evaluation set creation, and HTML editor functions allows an authenticated attacker to inject malicious JavaScript code that executes in the browsers of other users who view the affected content, potentially leading to account compromise or data theft.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Email Notification, Create Evaluation Sets, and HTML Editor functions of Squirro Cognitive Search versions prior to 3.14.2. The affected components fail to properly sanitize or escape user-supplied input, particularly script tags and event handlers (e.g., <img src=x onerror=alert(1)>), allowing an attacker to inject arbitrary JavaScript code into template data that persists in the application. When other users access the affected templates or content, the injected script executes in their browser context within the application. The vulnerability requires authentication to the application and can be exploited through email templates and evaluation set creation functions. Patches are available in version 3.14.2 and later.
Affected products
- Squirro Cognitive Search before 3.14.2
Timeline
- 2026-08-17: disclosed