Executive brief
SkillTree is a gamification platform used to deliver micro-learning training. Prior to version 4.4.2, attackers can register with malicious code in their name fields, which gets stored and later executed in administrators' browsers when they view quiz activity reports. This allows attackers to steal sensitive tokens, modify user accounts, delete projects, or execute arbitrary actions as an admin without any phishing or user interaction beyond the admin viewing reports through normal use.
Technical details
The vulnerability combines two code flaws: the registration endpoint accepts `firstName`, `lastName`, and `nickname` fields without HTML sanitization, and the front-end components `StringHighlighter.js` and `HighlightedValue.vue` render user-supplied data via Vue's `v-html` directive (which sets `innerHTML`) with no entity encoding. An attacker self-registers with a 28-character payload like `<img src=x onerror=alert(1)>` in the `firstName` field, bypassing the 30-character field limit. When an admin views the Quiz Runs page, the payload executes in their browser context with admin privileges. The advisory documents three escalating attack paths: basic XSS for arbitrary code execution, remote script loading via `import()` to perform admin actions, and CSRF token theft via `eval()` to relay API responses to an attacker. The session cookie is marked `HttpOnly` but the XSRF token is not, allowing token exfiltration. The patch is available in version 4.4.2.
Affected products
- SkillTree SkillTree prior to 4.4.2
Timeline
- 2026-09-09: disclosed