Quick answers
- Is CVE-2026-50771 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-50771 being exploited in the wild.
- How severe is CVE-2026-50771?
- Medium severity, with a CVSS score of 6.1, published 17 August 2026.
- Which products and versions are affected?
- Squirro Cognitive Search before 3.14.2.
- Is there a fix for CVE-2026-50771?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-50771 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-50771?
- Check whether you run Squirro Cognitive Search at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Email Notification, Create Evaluation Sets, and HTML Editor functions of Squirro Cognitive Search versions prior to 3.14.2. The affected components fail to properly sanitize or escape user-supplied input, particularly script tags and event handlers (e.g., <img src=x onerror=alert(1)>), allowing an attacker to inject arbitrary JavaScript code into template data that persists in the application. When other users access the affected templates or content, the injected script executes in their browser context within the application. The vulnerability requires authentication to the application and can be exploited through email templates and evaluation set creation functions. Patches are available in version 3.14.2 and later.
Affected products
- Squirro Cognitive Search before 3.14.2
Timeline
- 2026-08-17: disclosed