Executive brief
LimeSurvey is an open-source survey platform used to create and distribute online forms and questionnaires. This vulnerability allows an authenticated attacker to inject malicious JavaScript code via the HTML editor popup, potentially hijacking user sessions, stealing sensitive survey data, or defacing survey content when other administrators or users click a crafted link.
Technical details
This is an authenticated reflected cross-site scripting (XSS) vulnerability in the HTML editor popup endpoint of LimeSurvey Community Edition 7.0.5. The vulnerable parameters (text and name) are processed through a blacklist-based sanitizer but rendered without proper context-aware output encoding, allowing bypasses. An authenticated attacker can craft a malicious URL containing JavaScript payloads that execute in the victim's browser. This requires the victim to be logged in and click the attacker-supplied link. No patch status is indicated in the advisory.
Affected products
- LimeSurvey Community Edition 7.0.5
Timeline
- 2026-08-14: disclosed
- other: CVE-2026-63361 assigned