# CVE-2026-81635: SHIRASAGI cross-site scripting in guided procedures

Source: https://junglewise.ai/threats/cve-2026-81635-shirasagi-cross-site-scripting-in-guided-procedures  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-81635 · Severity: medium · CVSS 5.4 · Published 2026-09-10

SHIRASAGI is a web-based content management and groupware platform. A cross-site scripting vulnerability in the guided procedures feature allows attackers to execute malicious scripts in the browsers of users who view crafted procedure links, potentially leading to session hijacking, credential theft, or unauthorized data access.

Technologies: [SHIRASAGI Project SHIRASAGI](https://junglewise.ai/threats/technologies/shirasagi). Vendors: [SHIRASAGI Project](https://junglewise.ai/threats/vendors/shirasagi-project).

## Quick answers

**Is CVE-2026-81635 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81635 being exploited in the wild.

**How severe is CVE-2026-81635?** Medium severity, with a CVSS score of 5.4, published 10 September 2026.

**Which products and versions are affected?** SHIRASAGI Project SHIRASAGI v1.14.0 to v1.20.2.

**Is there a fix for CVE-2026-81635?** A patch was published on 2026-09-10: v1.21.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81635 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81635?** Check whether you run SHIRASAGI Project SHIRASAGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cross-site scripting (CWE-79) vulnerability exists in SHIRASAGI's guided procedures feature. The vulnerability arises from insufficient input validation on procedure link URLs, allowing an authenticated administrator to inject malicious JavaScript code that executes in the context of end users' browsers when they access the affected procedures. Attack requires prior authentication to the CMS admin panel and social engineering to trick users into viewing the malicious procedure. An attacker can achieve script execution to steal cookies, session tokens, or perform actions on behalf of the victim user. The vulnerability affects versions v1.14.0 through v1.20.2 and is fixed in v1.21.0.

## Affected products

- SHIRASAGI Project SHIRASAGI v1.14.0 to v1.20.2

## Timeline

- 2026-09-10: disclosed
- 2026-09-10: patched: v1.21.0 released

## References

- [https://jvn.jp/en/jp/JVN37476837/](https://jvn.jp/en/jp/JVN37476837/)
- [https://www.ss-proj.org/support/1710.html](https://www.ss-proj.org/support/1710.html)

## Related threats

- [SHIRASAGI OS command injection in open data harvest import](https://junglewise.ai/threats/cve-2026-118869-an-os-command-injection-vulnerability-exists-in-shirasagi-which)
- [SHIRASAGI cross-site scripting in advertisement pages](https://junglewise.ai/threats/cve-2026-117679-a-cross-site-scripting-vulnerability-exists-in-shirasagi-which)
- [SHIRASAGI authorization bypass in shared files](https://junglewise.ai/threats/cve-2026-82582-shirasagi-authorization-bypass-in-shared-files)