# CVE-2026-59661: Repasat Cross-Site Scripting in route update endpoint

Source: https://junglewise.ai/threats/cve-2026-59661-cross-site-scripting-vulnerability-in-the-repasat-application  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-59661 · Severity: info · Published 2026-10-02

Repasat is a business management platform that consolidates operations onto a single platform. A cross-site scripting vulnerability in the route update feature allows attackers to inject malicious code that executes in a user's browser, potentially leading to account compromise or data theft if an authenticated user is tricked into visiting a malicious link.

Technologies: [Repasat](https://junglewise.ai/threats/technologies/repasat). Vendors: [Repasat](https://junglewise.ai/threats/vendors/repasat).

## Quick answers

**Is CVE-2026-59661 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59661 being exploited in the wild.

**How severe is CVE-2026-59661?** Informational severity, published 2 October 2026.

**Which products and versions are affected?** Repasat prior to patch version 20260402.

**Is there a fix for CVE-2026-59661?** Yes: fixed in Patch version 20260402 (April 2026). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59661 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-59661?** Check whether you run Repasat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Patch version 20260402 (April 2026)

## Technical details

The "nomRuta" parameter in the /es/routes/update/693 endpoint is not properly sanitized, allowing stored or reflected XSS attacks. Exploitation requires authentication and user interaction (clicking a malicious link). An attacker can execute arbitrary JavaScript in the victim's browser context with the same privileges as the logged-in user.

## Affected products

- Repasat Repasat prior to patch version 20260402

## Timeline

- 2026-10-02: disclosed

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application)

## Related threats

- [Repasat application cross-site scripting in company size parameter](https://junglewise.ai/threats/cve-2026-59668-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat cross-site scripting in company size employees endpoint](https://junglewise.ai/threats/cve-2026-59667-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat business management software XSS vulnerabilities](https://junglewise.ai/threats/cve-2026-59666-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat cross-site scripting in parameters](https://junglewise.ai/threats/cve-2026-95662-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat multiple cross-site scripting vulnerabilities](https://junglewise.ai/threats/cve-2026-59673-cross-site-scripting-vulnerability-in-the-repasat-application)