Executive brief
Kiwi TCMS, an open-source test management system, is vulnerable to a security flaw where malicious links can be saved within test plans and test cases. If a user clicks on one of these specially crafted links, an attacker could execute unauthorized scripts in the user's browser. While default installations using Docker are protected by built-in security headers, customized setups may be at risk of data theft or account hijacking.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Kiwi TCMS due to improper neutralization of user-controllable input in the `TestCase.extra_link` and `TestPlan.extra_link` fields. An attacker can inject a `javascript:` URI which is rendered verbatim in the UI, allowing for script execution when a user interacts with the link. The vulnerability is mitigated in official Docker deployments by a strict Content-Security-Policy (CSP) header that blocks inline JavaScript, but remains exploitable in environments with modified security settings. The issue is resolved in version 16.1, which introduces proper sanitization and resets non-conforming database records to null.
Affected products
- Kiwi TCMS Kiwi TCMS < 16.1
Timeline
- 2026-06-24: disclosed: Initial disclosure by reporter
- 2026-06-24: patched: Version 16.1 released
- 2026-07-06: advisory: GitHub Advisory published
References
- https://api.github.com/users/alanturing881
- https://github.com/alanturing881
- https://api.github.com/users/alanturing881/gists%7B/gist_id%7D
- https://api.github.com/users/alanturing881/repos
- https://avatars.githubusercontent.com/u/286391906?v=4
- https://api.github.com/users/alanturing881/events%7B/privacy%7D