Executive brief
Sakai Conversations is a discussion tool used in educational learning management systems. An authenticated student or instructor can embed malicious JavaScript in forum posts or comments, which then executes automatically in the browsers of all other course members who view that content. This allows attackers to steal credentials, access sensitive academic records, perform unauthorized actions on behalf of victims, or compromise an entire course's student body with a single malicious post.
Technical details
The vulnerability is a stored XSS in Sakai Conversations affecting versions 23.0–23.3. The REST API endpoints POST /api/sites/{siteId}/topics, POST /api/sites/{siteId}/topics/{topicId}/posts, and the comment storage mechanism accept and store user-supplied message content directly to the database (conv_topics.MESSAGE, conv_posts.MESSAGE, conv_comments.MESSAGE) without invoking FormattedText.processFormattedText() or any equivalent HTML sanitizer. On the frontend, the LitElement components (SakaiTopic.js, SakaiPost.js, SakaiComment.js) render stored messages using the unsafeHTML() directive, which bypasses HTML escaping and allows stored payloads to execute. Attack requires only valid site membership (student role or higher) and network access to the Conversations API; user interaction is required from victims viewing the malicious content. Attackers can exfiltrate session cookies, perform actions on behalf of users, and access gradebook and course data. A fix was committed to master on 2026-06-02 (commit 2696b4b48cbef2e81512f52f84f7477adff78b27); patched versions are pending release.
Affected products
- Sakai Project Sakai Conversations 23.0 through 23.3
- Sakai Project Sakai Kernel 23.0 through 23.3
- Sakai Project Sakai Rubrics 23.0 through 23.3
Timeline
- 2026-08-24: disclosed: GitHub Advisory GHSA-w2x5-gv52-9ccv published
- 2026-06-02: patched: Fix committed to master branch (commit 2696b4b48cbef2e81512f52f84f7477adff78b27)
- 2026-06-11: other: Fix included in Sakai release 23.5 (per GitHub References)