CVE-2026-54049: Sakai Conversations stored cross-site scripting in messages

CVE-2026-54049 · Severity: high · CVSS 8.7 · Published 2026-10-01

Sakai Conversations is a discussion tool used in educational learning management systems. An authenticated student or instructor can embed malicious JavaScript in forum posts or comments, which then executes automatically in the browsers of all other course members who view that content. This allows attackers to steal credentials, access sensitive academic records, perform unauthorized actions on behalf of victims, or compromise an entire course's student body with a single malicious post.

Technologies: org.sakaiproject.kernel:sakai-kernel-impl (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-54049 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54049 being exploited in the wild.
How severe is CVE-2026-54049?
High severity, with a CVSS score of 8.7, published 1 October 2026.
Which products and versions are affected?
org.sakaiproject.conversations:sakai-conversations-impl (Maven) >= 23.0, <= 23.3, ECOSYSTEM:introduced=23.0,last_affected=23.3; org.sakaiproject.kernel:sakai-kernel-impl (Maven) >= 23.0, <= 23.3, ECOSYSTEM:introduced=23.0,last_affected=23.3; org.sakaiproject.rubrics:rubrics-impl (Maven) >= 23.0, <= 23.3, ECOSYSTEM:introduced=23.0,last_affected=23.3; Sakai Project Sakai Conversations 23.0 through 23.3; and 2 more.
Is there a fix for CVE-2026-54049?
A patch was published on 2026-06-02: Fix committed to master branch (commit 2696b4b48cbef2e81512f52f84f7477adff78b27) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54049 attacked?
It is attacked over the network.
Am I affected by CVE-2026-54049?
Check whether you run org.sakaiproject.conversations:sakai-conversations-impl (Maven), org.sakaiproject.kernel:sakai-kernel-impl (Maven), org.sakaiproject.rubrics:rubrics-impl (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored XSS in Sakai Conversations affecting versions 23.0–23.3. The REST API endpoints POST /api/sites/{siteId}/topics, POST /api/sites/{siteId}/topics/{topicId}/posts, and the comment storage mechanism accept and store user-supplied message content directly to the database (conv_topics.MESSAGE, conv_posts.MESSAGE, conv_comments.MESSAGE) without invoking FormattedText.processFormattedText() or any equivalent HTML sanitizer. On the frontend, the LitElement components (SakaiTopic.js, SakaiPost.js, SakaiComment.js) render stored messages using the unsafeHTML() directive, which bypasses HTML escaping and allows stored payloads to execute. Attack requires only valid site membership (student role or higher) and network access to the Conversations API; user interaction is required from victims viewing the malicious content. Attackers can exfiltrate session cookies, perform actions on behalf of users, and access gradebook and course data. A fix was committed to master on 2026-06-02 (commit 2696b4b48cbef2e81512f52f84f7477adff78b27); patched versions are pending release.

Affected products

  • Sakai Project Sakai Conversations 23.0 through 23.3
  • Sakai Project Sakai Kernel 23.0 through 23.3
  • Sakai Project Sakai Rubrics 23.0 through 23.3

Identifiers

  • CVE-2026-54049
  • GHSA-w2x5-gv52-9ccv

Timeline

  • 2026-08-24: disclosed: GitHub Advisory GHSA-w2x5-gv52-9ccv published
  • 2026-06-02: patched: Fix committed to master branch (commit 2696b4b48cbef2e81512f52f84f7477adff78b27)
  • 2026-06-11: other: Fix included in Sakai release 23.5 (per GitHub References)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.